> For the complete documentation index, see [llms.txt](https://linux-tutorial-cli.gitbook.io/linux-cli-tutorial/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://linux-tutorial-cli.gitbook.io/linux-cli-tutorial/txt-files/file-systems-cocepts/lpic3-305/unshare.md).

# unshare

The `unshare` command in Linux is used to run a program with some namespaces unshared from the current process. This command is particularly useful for creating isolated environments where certain resources (such as network, PID, mount points, etc.) can be separated from the parent process, making it a key tool for containerization, testing, and security purposes.

#### Syntax

```bash
unshare [OPTION]... [COMMAND [ARGUMENTS...]]
```

#### Key Options

**1. Unshare Network Namespace (`--net`)**

Creates a new network namespace, isolating network resources (such as IP addresses, routing tables, and interfaces) from the parent process.

* **Example:**

  ```bash
  unshare --net bash
  ```

  This will create a new `bash` shell in a new network namespace where network configurations (e.g., IP addresses, interfaces) are separate from the host system.

**2. Unshare Mount Namespace (`--mount`)**

Creates a new mount namespace, allowing the process to have a different set of mount points (i.e., filesystems) than the parent process.

* **Example:**

  ```bash
  unshare --mount bash
  ```

  This starts a new `bash` shell with its own mount namespace, meaning filesystem changes (like mounts or unmounts) will not affect the host.

**3. Unshare PID Namespace (`--pid`)**

Creates a new PID namespace. This means that the process will have its own process ID (PID) space, so it can have a different PID compared to the parent process.

* **Example:**

  ```bash
  unshare --pid bash
  ```

  This starts a new `bash` shell with a separate PID namespace, and processes inside this shell will have different PIDs from those on the host.

**4. Unshare UTS Namespace (`--uts`)**

Isolates the hostname and domain name for the process. This allows you to change the hostname inside the process without affecting the host.

* **Example:**

  ```bash
  unshare --uts bash
  ```

  This will launch a new `bash` shell with a different hostname, which can be modified with the `hostname` command.

**5. Unshare User Namespace (`--user`)**

Creates a new user namespace, allowing the process to have separate user and group IDs from the parent. This is especially useful in security contexts for privilege separation.

* **Example:**

  ```bash
  unshare --user bash
  ```

  This runs a `bash` shell with a new user namespace, and the process can have different user/group IDs from the parent process.

**6. Unshare Cgroup Namespace (`--cgroup`)**

Isolates the control groups (cgroups) for resource management. This allows the process to operate under different cgroup constraints.

* **Example:**

  ```bash
  unshare --cgroup bash
  ```

**7. Unshare Multiple Namespaces**

You can combine several options to unshare multiple namespaces at once. For example, to unshare the PID, user, and mount namespaces:

* **Example:**

  ```bash
  unshare --pid --user --mount bash
  ```

  This runs a `bash` shell with separate PID, user, and mount namespaces.

#### Practical Examples

1. **Running a command in a new network namespace**:

   ```bash
   unshare --net bash
   ```

   This creates a new shell where network interfaces and settings are isolated from the host system. You can configure network settings within this namespace independently.
2. **Running a command with a separate PID namespace**:

   ```bash
   unshare --pid bash
   ```

   This starts a new `bash` process in a different PID namespace, allowing for separate process IDs and independent process management.
3. **Using a different hostname within a new UTS namespace**:

   ```bash
   unshare --uts bash
   ```

   Inside this shell, you can change the hostname independently of the host.
4. **Running a process in a new user namespace**:

   ```bash
   unshare --user bash
   ```

   This creates a new `bash` shell where user and group IDs are isolated from the host system, which is useful for running unprivileged tasks.

#### Managing Namespaces

Namespaces can be very useful for security and resource isolation, particularly in scenarios like:

* **Containerization**: `unshare` can be used to mimic container behavior by isolating namespaces.
* **Testing**: For testing how processes behave in isolated environments, such as testing networking setups without affecting the host.
* **Security**: Isolating certain processes to minimize the risk of privilege escalation or resource exhaustion.

#### Conclusion

The `unshare` command provides a powerful way to create isolated environments by unsharing various namespaces in Linux. This is crucial for containerization, testing, and enhancing system security. Understanding how to use `unshare` with different namespaces allows you to manage and control processes in a fine-grained way, giving you flexibility and isolation without requiring full virtualization.