34

How to detect namespacing

Use following commands and compare the outputs:

# List init process namespaces
readlink /proc/1/ns/*

# List target process namespaces (replace <pid>)
readlink /proc/<pid>/ns/*
#Linux #Security

Need to determine if a process is running in an isolated environment like a container or sandbox? Check its namespaces! Here’s how:

To check if a process is namespaced, compare its namespaces with those of the init process. You can do this by examining the symbolic links in the /proc/<pid>/ns/ directory for both processes. Each symbolic link corresponds to a namespace type and contains a string with the namespace type and inode number. If the inode number for any namespace type doesn’t match between your process and the init process, your process is namespaced.

Note: This check works only from outside the container/sandbox, and you’ll need root access to /proc/1/ns.

Use the following commands:

Icon with a waving hand

Get in touch

sigma star gmbh
Eduard-Bodem-Gasse 6, 1st floor
6020 Innsbruck | Austria

sigma star gmbh logo