Linux namespaces
termIT supportcloud
The kernel mechanism that gives a process its own view of a system resource - process table, network stack, mount points, hostname, users, inter-process communication - so that what it sees is not what the host sees.
Namespaces provide the isolation half of containers, as cgroups provide the accounting half. The security consequence is the one most often missed: isolation here is a kernel-enforced illusion, not a hardware boundary, so every container on a host shares one kernel and one kernel vulnerability. Treating containers as if they were virtual machines is the single most common architectural mistake in the field - user namespaces narrow the gap but do not close it.
Also known as: pid namespace, network namespace, mount namespace, user namespace