unshare 命令

常用示例

说明

unshare creates new namespaces and then executes the specified program within them. If no program is specified, it runs the shell. Namespaces provide isolation for system resources.

参数

-f, --fork

Fork before executing (required for PID namespace)

-r, --map-root-user

Map current user to root in user namespace

--map-user=UID

Map to specified UID in user namespace

--map-group=GID

Map to specified GID in user namespace

-R, --root=DIR

Set root directory

-w, --wd=DIR

Set working directory

--propagation private|shared|slave|unchanged

Set mount propagation

--mount-proc=DIR

Mount /proc in new mount namespace

--kill-child=signame

When unshare terminates, send signal to the forked child (default: SIGKILL). Useful with --pid to kill entire process tree.

-c, --map-current-user

Map current effective user and group IDs to themselves in the new user namespace. Implies --setgroups=deny and --user.

-S, --setuid _uid_

Set the user ID in the entered namespace.

-G, --setgid _gid_

Set the group ID in the entered namespace and drop supplementary groups.

--setgroups allow|deny

Allow or deny setgroups(2) in a user namespace.

--keep-caps

Keep capabilities granted in the user namespace in the child process.