[go: up one dir, main page]
|
|
Log in / Subscribe / Register

Namespaces in operation, part 4: more on PID namespaces

Namespaces in operation, part 4: more on PID namespaces

Posted Jan 31, 2013 16:26 UTC (Thu) by alex2 (guest, #73934)
Parent article: Namespaces in operation, part 4: more on PID namespaces

Can the network namespace be used to restrict a program so it can't phone home? Sometimes I'd like to test some commercial demo version but I really don't want it to report an unknown amount information back to the company.

to post comments

Namespaces in operation, part 4: more on PID namespaces

Posted Feb 5, 2013 12:50 UTC (Tue) by Lennie (guest, #49641) [Link]

You can setup iptables inside the network namespace, if you trust the program not to change it, you'll be fine.

This is because I'm not sure how well you can control what packets can and can not be send from the network namespace from the parent namespace.

Namespaces in operation, part 4: more on PID namespaces

Posted Feb 5, 2013 16:18 UTC (Tue) by bjencks (subscriber, #80303) [Link]

A fresh network namespace only has a loopback interface. If you don't add any other interfaces, it's totally isolated network-wise.

(Note that you can still connect to filesystem-namespace unix sockets if you can access them as files -- you need to chroot or use mount namespaces if you want to hide them as well. I believe abstract namespace unix sockets are isolated per-namespace.)


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds