Re: [PATCH 2/2] unshare: allow persisting namespaces

[ebiederm@xmission.com (Eric W. Biederman)]

Karel Zak <kzak@redhat.com> writes:

> On Sun, Dec 28, 2014 at 09:23:38PM +0100, Lubomir Rintel wrote:
>> Bind mount the namespace file to a given location after creating it if
>> requested (analogously to what "ip netns" and other tools do). This makes
>> it possible for a namespace to survive with no processes running while
>> processes can enter it with nsenter(1):
>> 
>>   # unshare --uts=utsns hostname behemoth
>>   # nsenter --uts=utsns hostname
>>   behemoth
>
> Nice, especially when we already supports the same concept in nsenter.
>
> But I guess that "empty namespace" (without any running process) is
> impossible for PID namespaces, right? It would be nice to add a note
> about it to the man page.

No.  An empty pid namespace is valid.   An empty pid namespace is one
in which an init process has not entered the pid namespace, or one in
which the init process has exited (and thus no more processes are
allowed).

So an empty pid namespace is a little weird but valid.

The implementation details of the patch completely baffle me.  I can't
see a reason for things being implemented with clone for example.

Eric