From Fedora Project Wiki


Demonstrating escaping namespacing


I created a small Go program that prints out /etc/redhat-release called show_distro. The source code for it can be viewed here.

The Dockerfile for this demo is extremely simple. You can view the Dockerfile here.


We will use container running CentOS on a Fedora 25 distribution to show how you can run an executable in the container namespace and the hostname (from the container).

Run the container to enter into it. Note the bind mount of a shared directory and the bind mount of /proc.

[bbaude@bbaude go-container]$ docker run -it --rm --privileged --pid=host --net=host -v /proc:/host/proc -v /shared:/shared my_image /bin/bash

We need to copy the Go executable to somewhere that both the host and container can run it.

[root@bbaude /]# cp /show_distro /shared

Let's run the executable in the container namespace. Remember the container is running CentOS.

[root@bbaude /]# /shared/show_distro 
CentOS Linux release 7.3.1611 (Core) 

Now we run the executable from the container but in the host's namespace using nsenter. Even though you are executing the command "in the container", the the host's namespace must be able to resolve the executable to work. Remember the host is running Fedora 25.

[root@bbaude /]# nsenter --mount=/host/proc/1/ns/mnt -- /shared/show_distro 
Fedora release 25 (Twenty Five)