We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the Wiki Team page for instructions how to help or browse through our new wiki at wiki.linux-vserver.org to find the information already migrated.

Namespaces

You may have heard that alpha util-vserver use so called namespaces and wonder what namespaces are and more important, what they are good for.

This document should give you some insights (hopefully ;)).

What are namespaces?

Namespaces are a feature of the linux kernel that allow different processes to have a different view on the filesystem.

Normally there is just a single filesystem tree with different mounts here and there. Now with namespaces you can have different mounts/views for different processes.

What does this mean?

This means that if process A and process B are in different namespaces, (un-)mounting in one namespace does not affect the other namespace. When you mount something it only appears in the current namespace and if you unmount something it only disappears in the current namespace.

Namespace are automagically destroyed once all processes which use that namespace have died and all mounts are also automagically unmounted, so you don't have to take care that some dead mounts are hanging around and keeping you from, for example, removing a media from a cdrom drive (of course you have to take care that all processes died ;)).

How does alpha util-vserver use them?

Using the default settings, alpha util-vserver creates a new namespace for each vserver. There are at least two points in doing this, one being cosmetic, one being related to security.

The cosmetic reason is that your host's namespace isn't cluttered with all those mounts inside the vservers. Security is added since alpha util-vserver also overlays the original root directory with the vserver's root directory (using a recursive bind mount), that way chroot break-outs fail since you end up being in the root directory which is now the vserver's root directory anyway ;) (you can also secure your vservers against chroot break-outs if you don't use namespaces, see chroot-barrier).

Drawbacks?

Yes, there are some drawbacks if you use namespaces for your vservers, but only minor ones.

Since namespaces are isolated from each other, you cannot directly add a mount to a vserver using "mount", instead you have to switch to the vserver's namespace first. Fortunately alpha util-vserver comes with a tool that allows you to switch to a vserver's namespace easily.

# To get a bash in the namespace of vserver "myvserver":
vnamespace -e myvserver bash
# The same in context 123
vnamespace -e 123 bash

# To mount something in the namespace of vserver "myvserver":
vnamespace -e myvserver mount /dev/somenode /path/to/mount/point
# To unmount something in the namespace of context 123
vnamespace -e 123 umount /path/to/mount/point

Recent versions of alpha util-vserver automatically translate a vserver-name to a context id, with older tools you may have to use the context id. Remember that if you do bind mounts, the source of the bind mount has to be already available in the vserver's namespace.

Using the new configuration scheme you can also configure mounts for a vserver in the configuration to be automatically setup while starting the vserver, see [The Great Flower Page] for details.