一直对linux内核的namespace感到困惑，今天看了一下代码才知道，原来所谓的namespace其实就是给虚拟化用的，PID namespace其实就是建立一个新的PID空间，这样内部可以使用一套新的PID，而且不会和外部冲突。这也就是说某个进程其实会有两个PID，一个空间一个。
我写了段C代码来展示这个问题。
[c]
include
include
include
include
include
include
static int fork_child(void *arg)
{
int a = (int)arg;
int i;
pid_t pid;
printf("In the container, my pid is: %dn", getpid());
for (i = 0; i < a; i++) {
pid = fork();
if (pid < 0)
return pid;
else if (pid)
printf("pid of my child is %dn", pid);
else if (pid == 0) {
sleep(3);
exit(0);
}
}
return 0;
}
int main(int argc, char argv[])
{
int cpid;
void childstack, stack;
int flags;
int ret = 0;
int stacksize = getpagesize() 4;
if (argc != 2) {
fprintf(stderr, "Wrong usage.n");
return -1;
}
stack = malloc(stacksize);
if (!stack) {
perror("malloc");
return -1;
}
printf("Out of the container, my pid is: %dn", getpid());
childstack = stack + stacksize;
flags = CLONE_NEWPID | CLONE_NEWNS;
cpid = clone(fork_child, childstack, flags, (void *)atoi(argv[1]));
printf("cpid: %dn", cpid);
if (cpid < 0) {
perror("clone");
ret = -1;
goto out;
}
fprintf(stderr, "Parent sleeping 20 secondsn");
sleep(20);
ret = 0;
out:
free(stack);
return ret;
}
[/c]
运行结果：
$ sudo ./pid_container 3
Out of the container, my pid is: 7061
cpid: 7062
In the container, my pid is: 1
Parent sleeping 20 seconds
pid of my child is 2
pid of my child is 3
pid of my child is 4
其实被namespace化的不只是PID，还有很多东西，貌似它们合起来被称为container。可以看 include/linux/nsproxy.h：
struct nsproxy {
atomic_t count;
struct uts_namespace uts_ns;
struct ipc_namespace ipc_ns;
struct mnt_namespace mnt_ns;
struct pid_namespace pid_ns;
struct net *net_ns;
};
虚拟化的东西是越来越让人摸不清头脑了。。。。