2016 - Linux Namespaces - NET namespace
The Slovak original of this document: 2016 - Linux Namespaces - NET namespace (slovensky).
NET (network stack) namespaces in Linux
1 Úvod
The NET namespace (network stack) isolates the network resources. Each network namespace has its own devices, addresses, routing tables, port numbers and its own "/proc/net" directory.
2 Working with NET namespaces
2.1 Creating new NET namespaces
Create two network (NET) namespaces, the first named "ns1" and the second "ns2".
# ip netns add ns1 # ip netns add ns2
2.2 Checking that the new network (NET) namespaces exist
# ls -l /var/run/netns ---------------------------------------------------------------------------------------------------------------- -r--r--r--. 1 root root 0 Nov 10 12:28 ns1 -r--r--r--. 1 root root 0 Nov 10 12:28 ns2
2.3 Listing every network (NET) namespace
List every network (NET) namespace with "ip".
# ip netns list ---------------------------------------------------------------------------------------------------------------- ns2 ns1 ---------------------------------------------------------------------------------------------------------------- # ip netns list-id ---------------------------------------------------------------------------------------------------------------- nsid 0 (iproute2 netns name: ns1) nsid 1 (iproute2 netns name: ns2)
2.4 Watching network (NET) namespaces come and go
"ip" with "netns monitor" watches network namespaces being created and removed.
# ip netns monitor ---------------------------------------------------------------------------------------------------------------- delete ns2 add ns2
2.5 Running processes inside network (NET) namespaces
The example below runs a BASH process in the namespace named "ns1".
[1]TERM1# ip netns exec ns1 bash
[2]TERM1# echo $$
----------------------------------------------------------------------------------------------------------------
27768
----------------------------------------------------------------------------------------------------------------
[3]TERM1# ifconfig -a
----------------------------------------------------------------------------------------------------------------
lo: flags=8<LOOPBACK> mtu 65536
loop txqueuelen 1 (Local Loopback)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0- [1] - In network namespace "ns1", exec the command "bash".
In effect we have "moved" into namespace "ns1", and every command that follows runs in it.
- [2] - Find the PID of the BASH process.
- [3] - List every network adapter available in namespace "ns1".
In the second terminal (TERM2), check that the new network namespace exists with "namespaces-info.sh", printing only the non-default namespaces (the -n switch). Two namespaces (MNT and NET) have been created for our BASH process (27768).
TERM2# ./namespaces-info.sh -n ---------------------------------------------------------------------------------------------------------------- ---------- + ---------- + -------------------- + ---------------------------------------- PID | PPID | NAMESPACE | COMMAND ---------- + ---------- + -------------------- + ---------------------------------------- 18 | 2 | mnt:[4026531856] | [kdevtmpfs] ---------- + ---------- + -------------------- + ---------------------------------------- 585 | 1 | mnt:[4026532423] | /usr/lib/systemd/systemd-udevd ---------- + ---------- + -------------------- + ---------------------------------------- 720 | 1 | mnt:[4026532450] | /usr/bin/vmtoolsd ---------- + ---------- + -------------------- + ---------------------------------------- 755 | 1 | mnt:[4026532451] | /usr/sbin/NetworkManager ---------- + ---------- + -------------------- + ---------------------------------------- 854 | 755 | mnt:[4026532451] | /sbin/dhclient ---------- + ---------- + -------------------- + ---------------------------------------- 27768 | 21524 | mnt:[4026532584] | bash 27768 | 21524 | net:[4026532455] | bash ---------- + ---------- + -------------------- + ----------------------------------------
The previous example listed every non-default namespace, each with its i-node number. The network namespace "net:[4026532455]" has i-node number "4026532455", which is the i-node number of the file "/var/run/netns/ns1". To check, print the i-node number of the file "/var/run/netns/ns1".
# ls -lhi /var/run/netns/ ---------------------------------------------------------------------------------------------------------------- 4026532455 -r--r--r--. 1 root root 0 Nov 15 13:59 ns1
2.6 Removing network (NET) namespaces
Remove the network (NET) namespace named "ns1" with "ip".
# ip netns del ns1
When a namespace is removed, every migratable network adapter in it is moved back to the default namespace.
2.7 Moving network devices between network (NET) namespaces
Network adapters that can be moved between network namespaces are those whose "netns-local" feature is "off" — in other words, those that are not local: \-- netns-local: off -> a migratable adapter \-- netns-local: on -> a non-migratable adapter (a local one)
"ethtool" will say which adapters are migratable. The example below checks "ens33". The output shows it is migratable — not local — because "netns-local" is "off".
# ethtool -k ens33 | grep netns-local ---------------------------------------------------------------------------------------------------------------- netns-local: off [fixed]