Mount namespace
A mount namespace is a Linux namespace that isolates the filesystem mount points visible to processes.
Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more
A mount namespace is a Linux namespace that isolates the filesystem mount view available to a process group.
- How it is used
- Isolates container filesystem views and helps Podman restrict processes to designated images and volumes.
- How deep it goes
- Explains rootfs, bind mounts, pivot_root, and CAP_SYS_ADMIN, while deferring escape resistance to SELinux and runtime security.
- Examples
- Demonstrates namespace identifiers with /proc, mounts /tmp/testfile over /etc/shadow using podman unshare, and inspects rootless mount support.
- What you can do after
- Operate Podman’s rootless isolation demonstrations and evaluate how filesystem visibility, capabilities, and SELinux constrain container processes.
Kubernetes in Action, Second Edition
A mount namespace is a Linux namespace that isolates the filesystem mount points visible to processes.
- How it is used
- Explains how containers receive separate filesystem views while selected files remain shareable through pod volumes.
- How deep it goes
- Defines filesystem isolation and contrasts separate mount namespaces with shared volumes, without detailing kernel implementation.
- Examples
- Uses containers in one pod with separate mount namespaces and a volume mounted into both.
- What you can do after
- Evaluate container filesystem visibility and recognize when a pod volume is needed for sharing files.
Read how Kubernetes in Action, Second Edition explains mount namespace →
Related concepts
- linux namespacekind of · A Linux namespace is a kernel mechanism that gives processes isolated views of selected system resources, such as processes, networks, or filesystem mounts.
- user ID namespaceuses · A user ID namespace is a Linux isolation mechanism that separates user and group identifiers and maps them between namespace and host contexts.
- CAP_SYS_ADMINconfigures · CAP_SYS_ADMIN is a Linux capability that includes permission to perform filesystem mounts and many other system-administration operations.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.