A PID namespace is a Linux namespace that isolates process identifiers and the visible process tree.
A PID namespace isolates process identifiers and hides the host process tree. Processes inside a container see only processes in that namespace, making the container feel like a separate system while reducing exposed host information. section 1.2section 10.4
Podman uses the namespace to provide process isolation:
Podman runs containers in their own PID namespaces by default. section 10.4
The container's /proc represents its namespace rather than the host's /proc, so processes inside the container can affect only other processes in that namespace. section 10.1
The isolation also masks knowledge of other host processes, but it should be treated as an additional boundary rather than a complete security mechanism. section 10.4
Compare private and host PID views
Running `podman run --rm ubi8 find /proc -maxdepth 1 -type d -regex ".*/[0-9]*"` normally shows only `/proc/1`. Adding `--pid=host` exposes the host process tree, including `/proc/2`, `/proc/3`, and other processes. Use host PID access only when an application must monitor host processes. section 10.4
How Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more covers it
How deep it goes
Explains namespace behavior, /proc effects, CLI configuration, and SELinux implications without descending into kernel internals.
Examples
Demonstrates default and host PID views with Podman commands that list numeric directories under /proc.
What it assumes
Assumes basic Linux containers and processes while defining namespaces and explaining their virtualized resource views.
What you can do after
Operate/configure Podman process visibility with the default namespace or the `--pid=host` option.
How it connects
Connects PID namespaces with Linux namespaces, /proc, SELinux, user namespaces, capabilities, and other container isolation mechanisms.
Kubernetes in Action, Second EditionA PID namespace is a Linux isolation scope that gives processes an isolated view of process identifiers and process hierarchy.
containerused by · A software container is an isolated execution environment that packages an application and its dependencies while sharing the host operating system kernel.
podconfigured by · A Kubernetes Pod is the smallest deployable unit in Kubernetes, grouping one or more co-located containers that share networking and other resources.
maskimplements · Masking is the selective representation, concealment, inclusion, exclusion, or restriction of parts of data or a system according to specified criteria.
This explainer was generated by Manning's knowledge graph from the text of Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more. The section links point to the parts of the book it draws on.
