# Two Objects not Namespaced by the Linux Kernel

DevFeed: [Two Objects not Namespaced by the Linux Kernel](<https://devfeed.tech/articles/two-objects-not-namespaced-by-the-linux-kernel-35215.md>)

Original publisher: [Read original article](<https://blog.jessfraz.com/post/two-objects-not-namespaced-linux-kernel/>)

Published: 2017-04-26T19:17:58Z

Content type: opinion

Language: en

Sources: [Jessie Frazelle](<https://devfeed.tech/sources/jessie-frazelle.md>)

Topics: [Linux Kernel](<https://devfeed.tech/topics/linux-kernel.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [Docker](<https://devfeed.tech/topics/docker.md>)

Tags: [containers](<https://devfeed.tech/tags/containers.md>), [docker](<https://devfeed.tech/tags/docker.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [linux](<https://devfeed.tech/tags/linux.md>), [linux-kernel](<https://devfeed.tech/tags/linux-kernel.md>)

## AI overview

The article explains that Linux kernel namespaces isolate what processes can see, while cgroups control what processes can use. It examines two resources that are not namespaced: system time and the kernel keyring. Changing time from a container can affect the host, and kernel keyring data may be visible across containers on the same host; Docker's default capabilities and seccomp profile restrict these operations.

## Source excerpt

If you are new to my blog then you might be new to the concept of Linux kernel namespaces. I suggest first reading Getting Towards Real Sandbox Containers and Setting the Record Straight: containers vs. Zones vs. Jails vs. VMs. Linux namespaces are one of the primitives that make up what is known as a "container." They control what a process can see. Cgroups, the other main ingredient of "containers", control what a process can use. But let's focus for this post on namespaces. The current set of namespaces in the kernel are: mount, pid, uts, ipc, net, user, and cgroup. These all cover basically exactly what they are named after. But what is not covered? Well, let's go over two of the things not namespaced by the Linux kernel. Time First, and my favorite to nerd out about, is time. Now, it should go without saying that if you want to set the time in Linux you need CAP_SYS_TIME. By default you do not get this capability in Docker containers. The settimeofday, etc syscalls are also blocked by the default seccomp profile in Docker as well. What happens if you do change the time in a container? Well, it's not namespaced so the time on the host would change as well. "But whaaaaa? I thought containers were just like a VM", you ask. Again, you should read my post Setting the Record Straight: containers vs. Zones vs. Jails vs. VMs. One of my favorite questions I have been asked at a conference is "If you could add any new namespace to Linux what would it be?" Obviously this is an awesome question, totally up my alley, and not even a statement from someone trying to prove to me "they know things." But I digress, I always answer with "Time." There is no production use case for this, other than making more NTP hell for yourself. I do believe there is a development use case: if you want to change the time for a test running in one container but not mess with the other tests running in other containers. What a fun way to make a chaos monkey for NTP! :P Kernel Keyring The kernel k