Run a program with some namespaces unshared from the parent.
medium risk
unshare creates new namespaces (network, PID, mount, user, UTS) and runs a command in them, isolated from the parent. Used to understand container internals, test namespace isolation, and create lightweight sandboxes without full container runtime.
| Flag | Meaning |
|---|---|
--net | Create new network namespace |
--pid | Create new PID namespace |
--mount | Create new mount namespace |
--user | Create new user namespace (unprivileged) |
--fork | Fork before executing command |
unshare --net bashShell with its own isolated network namespace (no interfaces) · explain & risk-check →unshare --user --map-root-user bashShell with root privileges in user namespace · explain & risk-check →unshare --pid --fork --mount-proc bashIsolated PID namespace (only sees own processes) · explain & risk-check →Use `unshare --net bash` to test how your app behaves with no network — quickly reveals hardcoded DNS lookups or network dependencies you didn't know existed.
Reference text is hand-written and may be incomplete — check man unshare for your version. Test destructive commands on a non-production system first.