Using nsenter to Access Container Namespaces: Syntax, Options, and Examples

nsenter is a util-linux command that runs a program in the namespace of a target process, making it useful for debugging container network namespaces and other namespaces when the container lacks basic networking tools.

Typical use case: entering a container's network namespace to run host‑side commands such as ip address , ping , or tcpdump for troubleshooting.

nsenter can also enter mnt , uts , ipc , pid , and user namespaces, and can set a root directory and working directory for the executed program.

Usage

Syntax:

nsenter [options] [program [arguments]]

Options

-t, --target pid   # target process PID
-m, --mount[=file] # enter mount namespace (optional file)
-u, --uts[=file]   # enter uts namespace (optional file)
-i, --ipc[=file]   # enter ipc namespace (optional file)
-n, --net[=file]   # enter net namespace (optional file)
-p, --pid[=file]   # enter pid namespace (optional file)
-U, --user[=file]  # enter user namespace (optional file)
-G, --setgid gid   # set GID for the program
-S, --setuid uid   # set UID for the program
-r, --root[=dir]   # set root directory
-w, --wd[=dir]     # set working directory

If no program is specified, the default shell ( $SHELL ) is executed.

Examples

Get the PID of a running nginx container:

[root@staight ~]# docker inspect -f {{.State.Pid}} nginx
5645

Enter the container's network namespace and list its interfaces:

[root@staight ~]# nsenter -n -t5645
# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 ...
18: eth0@if19: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 ...

In Kubernetes, retrieve the container ID and then use nsenter similarly:

[root@node1 test]# kubectl get pod test -oyaml | grep containerID
- containerID: docker://cf0873782d587dbca6aa32f49605229da3748600a9926e85b36916141597ec85

Principles

Namespace

Linux namespaces isolate various resources of a process. Types include mount, ipc, uts, net, pid, user, and cgroup, each providing an independent view of the corresponding subsystem.

clone

The clone system call creates a new process and can assign it to new namespaces using flags such as CLONE_NEWNET , CLONE_NEWUTS , etc.

setns

setns joins an existing namespace using a file descriptor from /proc/PID/ns/ , allowing a thread to move into that namespace.

nsenter

nsenter wraps setns by letting the user specify a target PID; it automatically opens the appropriate namespace files and executes the desired program inside them.