Docker内部使用了Net namespace进行网络隔离,我们也可以利用这种底层的特性来魔改容器。
运行中的容器都对应一个PID,每个PID都有自己的名称空间,它的名称空间在 /proc/[PID]/ns 下
ls -lah /proc/2047/ns/
total 0
dr-x--x--x 2 root root 0 Nov 22 09:41 .
dr-xr-xr-x 9 root root 0 Nov 22 09:41 ..
lrwxrwxrwx 1 root root 0 Nov 22 09:44 cgroup -> 'cgroup:[4026532459]'
lrwxrwxrwx 1 root root 0 Nov 22 09:44 ipc -> 'ipc:[4026532343]'
lrwxrwxrwx 1 root root 0 Nov 22 09:44 mnt -> 'mnt:[4026532341]'
lrwxrwxrwx 1 root root 0 Nov 22 09:41 net -> 'net:[4026532400]'
lrwxrwxrwx 1 root root 0 Nov 22 09:44 pid -> 'pid:[4026532344]'
lrwxrwxrwx 1 root root 0 Nov 22 09:52 pid_for_children -> 'pid:[4026532344]'
lrwxrwxrwx 1 root root 0 Nov 22 09:44 time -> 'time:[4026531834]'
lrwxrwxrwx 1 root root 0 Nov 22 09:52 time_for_children -> 'time:[4026531834]'
lrwxrwxrwx 1 root root 0 Nov 22 09:44 user -> 'user:[4026531837]'
lrwxrwxrwx 1 root root 0 Nov 22 09:44 uts -> 'uts:[4026532342]'