Docker Namespaces
Why Should a DevOps Engineer Care?
Docker does NOT create a virtual machine.
Instead, Docker uses Linux Kernel features called Namespaces and Cgroups to make a process feel like it is running on its own machine.
Think of Docker as a magician 🎩.
The process is actually running on the host Linux machine, but Docker tricks it into believing:
- “I have my own processes.”
- “I have my own network.”
- “I have my own filesystem.”
- “I have my own hostname.”
This magic is done using Linux Namespaces.
Before Docker Starts
Imagine your Linux server is a big apartment building.
Linux Host
│
├── Processes
├── Network
├── Filesystem
├── Users
└── Memory
After Docker Starts
Suppose Docker creates two containers.
Linux Host
│
├── Container-A
│ ├── nginx
│
├── Container-B
│ ├── mysql
│
└── Host Processes
├── sshd
├── docker
Now Container-A thinks: “Only nginx exists.”
Container-B thinks: “Only mysql exists.”
Host knows the truth. This isolation is Namespace magic.
Docker uses Linux Namespaces and Cgroups to make a process feel like it is running on its own machine.
Namespaces:
1. PID Namespace (Process Isolation)
— Like classrooms having their own roll numbers.
— Container sees only its own processes.
2. Network Namespace (Private Internet Connection)
— Like each apartment having its own WiFi and IP.
— Container gets its own network stack.
3. Mount Namespace (Private Cupboard)
— Like each roommate having their own cupboard.
— Container gets its own filesystem view.
4. UTS Namespace (Hostname Isolation)
— Container can have its own hostname.
— Host hostname remains unchanged.
5. IPC Namespace (Private WhatsApp Group)
— Isolates shared memory, message queues, semaphores.
6. User Namespace (Fake Root User)
— Container root can map to a non-root host user.
— Improves security.
7. Cgroups (Pocket Money Control)
— Controls CPU and Memory usage.
— Prevents one container from consuming all resources
PID Namespace (Process Isolation)
Real Life Example
Imagine a school.
Each classroom has:
Roll No 1
Roll No 2
Roll No 3
Class A:
1 Rahul
2 Aman
3 Rohit
Class B:
1 Neha
2 Priya
3 Simran
Get JAYANT BHAGAT’s stories in your inbox
Join Medium for free to get updates from this writer.
Same roll numbers.
No conflict.
PID Namespace works exactly like this.
Without Namespace
Host: ps -ef
Output:
PID 100 nginx
PID 200 mysql
PID 300 jenkins
Everyone visible with PID Namespace.
For a Container:
docker run -it ubuntu bash
Inside Docker
Container thinks:
I am PID 1.
Reality:
Host PID = 1777456
Docker is fooling the process.
What about other Namespace?
All other namespace does not create a PID.
It creates own resources related to namespaces, like net namespaces will create netork resources but has same PID
As a User jayant you can see for host macine there is different name space ,currently its not a docker
command: lsns
Let run a docker container and see the magic
what happen , this container create all differernt namespaces with same PID
Learn DevOps with Jayant Bhagat
If you enjoyed this Docker Namespaces guide and want to learn Docker, Kubernetes, AWS, Azure, Terraform, GitLab CI/CD, Jenkins, GitOps, Python for DevOps, and Real Production Troubleshooting, follow my content and join the community.
📺 YouTube Channel
Subscribe for: @jayantbhagat-Dops
✅ Real-world DevOps Projects
✅ Kubernetes Troubleshooting
✅ Docker Internals & Container Runtime
✅ Terraform Hands-on Labs
✅ AWS & Azure Automation
✅ GitLab CI/CD & Jenkins Pipelines
✅ Interview Preparation Sessions
✅ Live DevOps Classes
YouTube: [The Cloud Blueprint — YouTube]
