unshare(1)
Run a program in a new set of Linux namespaces, isolating it from the system.
Synopsis
unshare [OPTION]... [PROGRAM [ARG]...]Description
unshare creates new Linux namespaces and runs a program in them. Namespaces are used to isolate processes—each namespace instance provides its own view of system resources like the filesystem, network, process IDs, and users. This is fundamental to containerization and process isolation.
Without arguments, unshare starts a new shell in the specified namespaces. It's commonly used for testing namespace behavior, creating lightweight containers, or isolating network and filesystem changes.
Common options
| Flag | What it does |
|---|---|
-i, --ipc | Create a new IPC namespace (message queues, semaphores, shared memory) |
-m, --mount | Create a new mount namespace (isolated filesystem view) |
-n, --net | Create a new network namespace (isolated network stack) |
-p, --pid | Create a new PID namespace (process IDs start at 1) |
-u, --uts | Create a new UTS namespace (hostname and domain name) |
-U, --user | Create a new user namespace (UID/GID mapping) |
-r, --map-root-user | Map current user to root (UID 0) in new user namespace |
-f, --fork | Fork child process before executing program |
--mount-proc | Mount /proc in the new PID namespace |
-c, --cgroup | Create a new cgroup namespace |
Examples
Start a new shell in an isolated mount namespace; mount changes won't affect the host
unshare -m /bin/bashRun ip in an isolated network namespace as root; shows loopback-only network
unshare -n -r ip addrCreate a highly isolated environment with separate IPC, mount, network, PID, UTS, and user namespaces
unshare -i -m -n -p -u -r /bin/bashMount a tmpfs in /tmp within isolated namespace; invisible on host filesystem
unshare -m mount -t tmpfs none /tmp && ls /tmpCreate a file as root in user namespace; shows as owned by UID 0 inside the namespace
unshare -U -r touch /tmp/test && ls -l /tmp/testStart a shell with isolated PID and mount namespaces; mounts new /proc (PID 1 is the shell)
unshare -p -m --mount-proc -f /bin/bash