| name | cgroup-namespace |
| description | How to work with Linux CGroup namespaces for process isolation and security analysis. Use this skill whenever the user mentions cgroup namespaces, container isolation, process hierarchy inspection, namespace enumeration, or needs to understand how cgroups virtualize resource views. Also trigger when investigating privilege escalation paths, container escape scenarios, or analyzing process isolation boundaries. |
CGroup Namespace Operations
This skill helps you work with Linux CGroup namespaces for process isolation, security analysis, and understanding container boundaries.
What are CGroup Namespaces?
CGroup namespaces provide isolation of cgroup hierarchies for processes. They virtualize the view of the cgroup hierarchy so that processes within a namespace see only their own cgroup subtree, with their own cgroup appearing as the root.
Key points:
- Cgroup namespaces isolate the view of the hierarchy, not the resources themselves
- Resource control is still enforced by cgroup subsystems (CPU, memory, I/O)
- Processes see their own cgroup as the root of the hierarchy
- They cannot see or access cgroups outside their subtree
When to Use This Skill
Use this skill when you need to:
- Create or enter cgroup namespaces
- Enumerate cgroup namespaces on a system
- Check which namespace a process belongs to
- Investigate container isolation boundaries
- Analyze privilege escalation paths involving namespaces
- Understand process isolation in containerized environments
Creating CGroup Namespaces
Using unshare (CLI)
sudo unshare -C --mount-proc /bin/bash
unshare -fC --mount-proc /bin/bash
