Member-only story
Demystifying Linux PID Namespaces: The Engine Behind Container Isolation
If you have spent any time working with Docker or Kubernetes, you have likely heard the mantra: “Containers are not virtual machines; they are just isolated Linux processes.”
But what exactly creates this illusion of a virtual machine? How can a Node.js app running inside a container believe it is the only process on the entire system, blissfully unaware of the database running right next to it on the same host?
The answer lies in a feature of the Linux kernel called Namespaces. While Linux implements several types of namespaces (Network, Mount, User, IPC, UTS), the foundational pillar of container execution is the PID (Process ID) Namespace.
The Illusion of PID 1
In a standard Linux system, the kernel assigns a unique identifier called a Process ID (PID) to every running process. The very first process that starts when the system boots — typically systemd or init—is assigned PID 1. This process is the ancestor of all other processes and holds special responsibilities, like adopting orphaned child processes and passing signals.
When you run a container, the application inside often believes it is running as PID 1. If you run docker run alpine ps, the output looks something like this:
