linux - 创建非共享命名空间

Question

当运行 unshare 命令(man 1 unshare)时，它允许在与 shell 分开的命名空间中执行命令，为什么我仍然看到来自主持人？ PID 命名空间不是按设计取消共享的吗？

谢谢。

Answer 1

unshare 仅取消共享您通过选项设置的命名空间。请特别查看 --mount-proc 选项(引用自 unshare(1)):

Just before running the program, mount the proc filesystem at mountpoint (default is /proc). This is useful when creating a new PID namespace. It also implies creating a new mount namespace since the /proc mount would otherwise mess up existing programs on the system. The new proc filesystem is explicitly mounted as private (with MS_PRIVATE|MS_REC).

这很重要，因为 ps 命令从 /proc fs 读取 pids(请参阅 ps(1)):

This ps works by reading the virtual files in /proc.

另见 pid_namespaces(7):

After creating a new PID namespace, it is useful for the child to <...> mount a new procfs instance at /proc so that tools such as ps(1) work correctly.