unshare — run program with some namespaces unshared from parent
unshare
[options] program
[arguments]
Unshares specified namespaces from parent process and then executes specified program. Unshareable namespaces are:
mounting and unmounting filesystems will not affect
rest of the system (CLONE_NEWNS
flag), except for
filesystems which are explicitly marked as shared (by
mount --make-shared). See /proc/self/mountinfo for the
shared flags.
setting hostname, domainname will not affect rest of
the system (CLONE_NEWUTS
flag).
process will have independent namespace for System V
message queues, semaphore sets and shared memory
segments (CLONE_NEWIPC
flag).
process will have independent IPv4 and IPv6 stacks,
IP routing tables, firewall rules, the /proc/net
and /sys/class/net
directory trees,
sockets etc. (CLONE_NEWNET
flag).
children will have a distinct set of pid to process
mappings than their parent. (CLONE_NEWPID
flag).
process will have distinct set of uids, gids and
capabilities. (CLONE_NEWUSER
flag).
See the clone(2) for exact semantics of the flags.