Linux namespaces and container boundary analysis

Mechanism

Namespaces provide separate views of resources such as process IDs, mounts, users, and networking. Containers also rely on capabilities, cgroups, seccomp, and filesystem policy. A root identity inside a user namespace may map to an unprivileged host identity; conversely, an exposed host resource can bridge an otherwise separate view.

Practical method

Inspect namespace membership, UID mappings, mount information, and capability sets. Identify bind-mounted host paths and control sockets. Map each accessible resource to the authority it offers. Separate kernel vulnerabilities from deliberate but overbroad resource delegation.

cat /proc/self/uid_map
ls -l /proc/self/ns
cat /proc/self/mountinfo

Interpreting evidence

An escape claim should identify the host resource or missing boundary and show a harmless host-visible effect in the lab. Container root alone is not that evidence.

Pitfalls and limits

Privileged mode changes many constraints at once. A Docker socket delegates daemon authority. Namespace names are insufficient without membership and mapping details.