Linux namespaces isolate a process's view of system resources — process IDs, mount points, network interfaces, users and more. They are the building blocks of containers. Understanding them is key to detecting container context and reasoning about breakout.
What is Linux namespaces?#
Each namespace type virtualises one resource: PID (process tree), mount (filesystem view), net (interfaces), user (UID mapping), UTS (hostname), IPC and cgroup. A container is a process running in its own set of namespaces (plus cgroups and often seccomp/AppArmor).
Why LinPEAS checks linux namespaces#
LinPEAS uses namespace and cgroup signals to detect whether you are inside a container and to assess breakout conditions such as excessive capabilities, sensitive mounts, or a shared host namespace.
What a normal configuration looks like#
Containers run in dedicated namespaces with a user namespace mapping container-root to an unprivileged host UID, minimal capabilities and no sensitive host mounts.
Why it can be security-sensitive#
Sharing a host namespace (--pid=host, --net=host), running without user-namespace remapping, holding CAP_SYS_ADMIN, or mounting the host filesystem/Docker socket are all breakout enablers.
Understanding the concept tells you whether a LinPEAS highlight is a real problem here. The tool flags candidates; you confirm exploitability in context, and only act where authorised.
How to check it manually#
Run these read-only commands to inspect this area yourself and validate what LinPEAS reports:
ls -la /proc/self/nslsns 2>/dev/nullcat /proc/1/cgroupDefensive remediation#
- Use user namespaces to remap container-root to an unprivileged host UID.
- Do not share host PID/net/IPC namespaces unless required.
- Drop unneeded capabilities and avoid mounting the Docker socket into containers.
Sources & references
- HackTricks: Linux privilege escalation
- GTFOBins — abuse techniques for standard binaries
- PEASS-ng repository — reviewed 20260908-dffb9496