An IPC namespace isolates System V IPC objects, POSIX message queues, and the /dev/shm tmpfs from the host and other containers. Containers can therefore reuse IPC names without conflicts. section 10.6
Podman can connect containers to one IPC namespace with --ipc=container:NAME or by running them in a pod. They can communicate through IPC while remaining isolated from the host. The --ipc=host option instead exposes the host IPC namespace and disables that separation. section 10.6
Listing 10.8 IPC namespace keeping /dev/shm private to each container
$ podman run -d --rm --name ipc1 ubi8 bash -c "touch /dev/shm/ipc1; sleep 1000" #1 93df44264dd4b87d24f59dfffb92a6a0b6359bc5bcf94213d5e38499a10d3f3e $ podman run --rm ubi8 ls /dev/shm #2 $ podman run --rm --ipc=container:ipc1 ubi8 ls /dev/shm #3 ipc1
A command sequence demonstrates that /dev/shm is private by default, then visible to a container joining ipc1's namespace. section 10.6
Account for these security boundaries:
- Treat --ipc=host as a deliberate security exception because it permits access to host IPC resources. section 10.6
- On SELinux systems, containers sharing an IPC namespace receive a common SELinux label so their IPC communication is permitted. section 10.6
