What are Linux namespaces?

Runtime isolates each sandbox with a virtual machine, not only with namespaces. Every sandbox is a Firecracker microVM with its own Linux kernel. Inside a sandbox, you can use namespaces freely, through Docker or your own tools. A 2 vCPU, 4 GiB sandbox costs $0.03125 an hour while it sits idle (pricing).

How do namespaces work?

The kernel's man page describes namespaces this way: "A namespace wraps a global system resource in an abstraction that makes it appear to the processes within the namespace that they have their own isolated instance of the global resource." The first process in a new PID namespace gets PID 1 and becomes that namespace's init. A process in a new mount namespace can mount and unmount without the host noticing. Changes are visible to other members of the namespace, and to no one else.

Three system calls manage namespaces:

• clone starts a process in new namespaces when given CLONE_NEW* flags.
• unshare moves the calling process into new namespaces.
• setns joins an existing namespace through a file descriptor.

Each process lists its namespaces as links under /proc/<pid>/ns/. The lsns command prints them. Creating most namespaces requires CAP_SYS_ADMIN. Since Linux 3.8, a user namespace requires no privilege.

The eight namespace types

Are namespaces a security boundary?

Namespaces are one layer of a security boundary. Docker's security page says that "Namespaces provide the first and most straightforward form of isolation". A containerized process "cannot see, and even less affect" processes elsewhere. Namespaces change what a process can see. They do not change which kernel the process runs on. Every namespace on a machine is served by the same kernel, so a kernel bug triggered from inside one namespace can cross all of them. For this reason, container runtimes add cgroups, capabilities and seccomp on top. A container escape occurs when that stack fails.

Firecracker uses namespaces from the other side. Its jailer can place each monitor process in its own mount, network and PID namespaces on the host (jailer).

Why it matters for AI agent sandboxes

An agent sandbox built only from namespaces puts every tenant on one shared kernel. A microVM gives each tenant its own guest kernel. Namespaces inside the guest then serve the workload. They are not the wall between customers.

How Runtime relates to it

Inside a Runtime sandbox, you are root on your own kernel. sudo enable-docker installs Docker Engine. Its containers get their namespaces from the sandbox's kernel, not from the server's kernel (Docker).

Related: microVM vs container, nsjail vs Firecracker, run Docker in a sandbox.

Sources

Checked 25 October 2026.

• namespaces(7), man7.org
• pid_namespaces(7), man7.org
• Docker Engine security
• Firecracker jailer

Facts on this page were checked on 25 October 2026.