Namespaces

You may have heard that alpha util-vserver use so called namespaces and wonder what namespaces are and more important, what they are good for.

This document should give you some insights (hopefully ;)).

What are namespaces?

Namespaces are a feature of the linux kernel that allow different processes to have a different view on the filesystem.

Normally there is just a single filesystem tree with different mounts here and there. Now with namespaces you can have different mounts/views for different processes.

What does this mean?

This means that if process A and process B are in different namespaces, (un-)mounting in one namespace does not affect the other namespace. When you mount something it only appears in the current namespace and if you unmount something it only disappears in the current namespace.

A namespace is automagically destroyed once all processes using that namespace have died. All mounts are automagically unmounted in that namesapce, so you don't have to take care that some dead mounts hang around somewhere you can't access them and keep you from, for example, removing a media from your cdrom drive (of course you have to take care that all processes die ;)).

How does alpha util-vserver use them?

Using the default settings alpha util-vserver creates a new namespace for each vserver. There are at least two reasons for doing this:

Cosmetic

The cosmetic reason is that your host's namespace isn't cluttered with all those mounts inside the vservers, i.e. /proc/mounts only contains the list of mounts in the current namespace.

Security

Security is added since alpha util-vserver also overlay the original root directory with the vserver's root directory (using a recursive bind mount), that way chroot break-outs fail since you end up being in the root directory which is now the vserver's root directory anyway ;) (you can also secure your vservers against chroot break-outs if you don't use namespaces, see chroot-barrier).

Drawbacks?

Yes, there are some drawbacks if you use namespaces for your vservers, but only minor ones.

Since namespaces are isolated from each other, you cannot directly add a mount to a vserver using "mount". Instead you have to switch to the vserver's namespace first. Fortunately alpha util-vserver comes with a tool that allows you to switch to a vserver's namespace easily.

# get a bash in the namespace of vserver "myvserver":
vnamespace -e myvserver bash

#  same in context 123
vnamespace -e 123 bash

# mount something in the namespace of vserver "myvserver":
vnamespace -e myvserver mount /dev/somenode /path/to/mount/point

# unmount something in the namespace of context 123
vnamespace -e 123 umount /path/to/mount/point

# display all mounts in the namespace of 'myvserver'
vnamespace -e myvserver cat /proc/mounts

Recent versions of alpha util-vserver automatically translate a vserver-name to a context id, while older tools still require the use of the correct context id. Remember that if you do bind mounts, the source of the bind mount has to be already available in the vserver's namespace.

Using the new configuration scheme you can also configure mounts for a vserver to be automatically setup while starting the vserver, see The Great Flower Page for details.