unshare

The unshare command in Linux is used to run a program with some namespaces unshared from the current process. This command is particularly useful for creating isolated environments where certain resources (such as network, PID, mount points, etc.) can be separated from the parent process, making it a key tool for containerization, testing, and security purposes.

Syntax

unshare [OPTION]... [COMMAND [ARGUMENTS...]]

Key Options

1. Unshare Network Namespace (--net)

Creates a new network namespace, isolating network resources (such as IP addresses, routing tables, and interfaces) from the parent process.

• Example:

  unshare --net bash

  This will create a new bash shell in a new network namespace where network configurations (e.g., IP addresses, interfaces) are separate from the host system.

2. Unshare Mount Namespace (--mount)

Creates a new mount namespace, allowing the process to have a different set of mount points (i.e., filesystems) than the parent process.

• Example:

  unshare --mount bash

  This starts a new bash shell with its own mount namespace, meaning filesystem changes (like mounts or unmounts) will not affect the host.

3. Unshare PID Namespace (--pid)

Creates a new PID namespace. This means that the process will have its own process ID (PID) space, so it can have a different PID compared to the parent process.

• Example:

  unshare --pid bash

  This starts a new bash shell with a separate PID namespace, and processes inside this shell will have different PIDs from those on the host.

4. Unshare UTS Namespace (--uts)

Isolates the hostname and domain name for the process. This allows you to change the hostname inside the process without affecting the host.

• Example:

  unshare --uts bash

  This will launch a new bash shell with a different hostname, which can be modified with the hostname command.

5. Unshare User Namespace (--user)

Creates a new user namespace, allowing the process to have separate user and group IDs from the parent. This is especially useful in security contexts for privilege separation.

• Example:

  unshare --user bash

  This runs a bash shell with a new user namespace, and the process can have different user/group IDs from the parent process.

6. Unshare Cgroup Namespace (--cgroup)

Isolates the control groups (cgroups) for resource management. This allows the process to operate under different cgroup constraints.

• Example:

  unshare --cgroup bash

7. Unshare Multiple Namespaces

You can combine several options to unshare multiple namespaces at once. For example, to unshare the PID, user, and mount namespaces:

• Example:

  unshare --pid --user --mount bash

  This runs a bash shell with separate PID, user, and mount namespaces.

Practical Examples

1. Running a command in a new network namespace:

   unshare --net bash

   This creates a new shell where network interfaces and settings are isolated from the host system. You can configure network settings within this namespace independently.

2. Running a command with a separate PID namespace:

   unshare --pid bash

   This starts a new bash process in a different PID namespace, allowing for separate process IDs and independent process management.

3. Using a different hostname within a new UTS namespace:

   unshare --uts bash

   Inside this shell, you can change the hostname independently of the host.

4. Running a process in a new user namespace:

   unshare --user bash

   This creates a new bash shell where user and group IDs are isolated from the host system, which is useful for running unprivileged tasks.

Managing Namespaces

Namespaces can be very useful for security and resource isolation, particularly in scenarios like:

• Containerization: unshare can be used to mimic container behavior by isolating namespaces.

• Testing: For testing how processes behave in isolated environments, such as testing networking setups without affecting the host.

• Security: Isolating certain processes to minimize the risk of privilege escalation or resource exhaustion.

Conclusion

The unshare command provides a powerful way to create isolated environments by unsharing various namespaces in Linux. This is crucial for containerization, testing, and enhancing system security. Understanding how to use unshare with different namespaces allows you to manage and control processes in a fine-grained way, giving you flexibility and isolation without requiring full virtualization.