nsenter

Enter the namespaces of another process.

high risk

interactive breakdown — edit the command and press Explain
$ 
⚠ Risks & cautions
Safer / dry-run alternatives
nsenter -t <pid> -n ss -tnpEnter only the network namespace (-n) for read-only diagnostics.
What it does

nsenter runs a program in the namespace(s) of an existing process. Essential for debugging containerized processes — enter a container's network namespace to run network tools that aren't available inside the container, or debug a pod's network stack using host tools.

Common flags
FlagMeaning
-t --targetTarget process PID
-n --netEnter network namespace
-p --pidEnter PID namespace
-m --mountEnter mount namespace
--allEnter all namespaces
Examples
nsenter -t $(docker inspect -f '{{.State.Pid}}' mycontainer) -n ss -tnpRun ss inside a container's network namespace · explain & risk-check →
nsenter -t 1234 --net ip addrShow network interfaces from another process's view · explain & risk-check →
nsenter -t $(pgrep nginx | head -1) --all bashFull shell inside nginx's namespace · explain & risk-check →
Pro tip

Use nsenter to debug distroless or scratch containers that have no shell — run `nsenter -t <container-pid> -n tcpdump` from the host to capture traffic inside a container with no tools.

Related
docker exec kubectl exec lsof
Open the full explainer →More in System & Processes

Reference text is hand-written and may be incomplete — check man nsenter for your version. Test destructive commands on a non-production system first.