What are Linux namespaces?

Linux namespaces give a group of processes a private view of a kernel resource, such as process IDs, mounts or the network.

Runtime isolates each sandbox with a virtual machine, not only with namespaces: every sandbox is a Firecracker microVM with its own Linux kernel. Inside it you can still use namespaces freely, through Docker or your own tools, and a 2 vCPU, 4 GiB sandbox costs $0.03125 an hour while it waits (pricing).

How do namespaces work?

The kernel's man page puts it this way: "A namespace wraps a global system resource in an abstraction that makes it appear to the processes within the namespace that they have their own isolated instance of the global resource." The first process in a new PID namespace gets PID 1 and is that namespace's init. A process in a new mount namespace can mount and unmount without the host noticing. Changes are seen by other members of the namespace and by nobody else.

Three system calls manage them:

• clone starts a process in new namespaces when given CLONE_NEW* flags.
• unshare moves the calling process into new namespaces.
• setns joins an existing namespace through a file descriptor.

Each process lists its namespaces as links under /proc/<pid>/ns/, and lsns prints them. Creating most namespaces needs CAP_SYS_ADMIN; a user namespace needs no privilege since Linux 3.8.

The eight namespace types

Are namespaces a security boundary?

They are one layer of one. Docker's security page says "Namespaces provide the first and most straightforward form of isolation": a containerized process "cannot see, and even less affect" processes elsewhere. What namespaces change is what a process can see, not which kernel it runs on. Every namespace on a machine is served by the same kernel, so a kernel bug reached from inside one can cross them all. Container runtimes stack cgroups, capabilities and seccomp on top for that reason, and a container escape is what happens when the stack fails.

Firecracker uses namespaces from the other side: its jailer can put each monitor process in its own mount, network and PID namespaces on the host (jailer).

Why it matters for AI agent sandboxes

An agent sandbox built only from namespaces puts every tenant on one shared kernel. A microVM gives each tenant its own guest kernel, and namespaces inside the guest become a convenience for the workload, not the wall between customers.

How Runtime relates to it

Inside a Runtime sandbox you are root in your own kernel. sudo enable-docker installs Docker Engine, and its containers get their namespaces from the sandbox's kernel, not the server's (Docker).

Related: microVM vs container, nsjail vs Firecracker, run Docker in a sandbox.

Sources

Checked 25 September 2026.

• namespaces(7), man7.org
• pid_namespaces(7), man7.org
• Docker Engine security
• Firecracker jailer

Facts on this page were checked on 25 September 2026.