UNSHARE(1) UNSHARE(1) unshare - unshare [] [ []] unshare ( ) . , ,,${SHELL}" (: /bin/sh). , . ,,/proc/pid/ns/ " . nsenter(1) ( ). , umount(8) . . unshare ,,util-linux" 2.36 /proc/[pid]/ns/__ /proc/[pid]/ns/__ . 4.17 . unshare: mount namespace , ( mount --make-shared; /proc/self/mountinfo findmnt -o+ shared). , mount_namespaces(7). unshare ,,util-linux"- 2.27 private . --propagation unchanged. private . UTS namespace . , uts_namespaces(7). IPC namespace POSIX System V, . , ipc_namespaces(7). network namespace IPv4 IPv6 , IP , , /proc/net /sys/class/net , , . , network_namespaces(7). PID namespace -- . , pid_namespaces(7). cgroup namespace /proc/self/cgroup-, ,,cgroup" ,,cgroup" . , cgroup_namespaces(7). user namespace -, - . , user_namespaces(7). time namespace CLOCK_MONOTONIC- / CLOCK_BOOTTIME- /proc/self/timens_offsets. , time_namespaces(7). -i, --ipc[=] ,,IPC" . , . -m, --mount[=] . , . ( ). findmnt -o+ . . -n, --net[=] . , . -p, --pid[=] -. , . ( --fork .) --fork --mount-proc. -u, --uts[=] -. , . -U, --user[=] . , . -C, --cgroup[=] ,,cgroup" . , . -T, --time[=] . , . --monotonic --boottime . -f, --fork unshare- . . unshare , SIGINT SIGTERM . . --forward-signals Forward SIGTERM and SIGINT signals received by the parent unshare process to the child process. When this option is not specified, unshare ignores these signals while waiting for the child process to exit (the default behavior since util-linux 2.36). This allows the parent to remain alive while the child process handles the signals. This option is useful when the parent unshare process will receive SIGTERM or SIGINT signals (for example, during system reboot or from a process manager), and you want the child process to be notified of graceful shutdown requests so it can perform cleanup operations. If your child process has signal handlers (such as shell trap handlers), enabling this option allows them to execute. This option implies --fork. --keep-caps --user , . --kill-child[=-] unshare , - . --pid unshare. , - SIGKILL. --fork. --mount-proc[=-] , ,,proc" - ( /proc). -. /proc . ,,proc" ( MS_PRIVATE|MS_REC). --mount-binfmt[=-] Just before running the program, mount the binfmt_misc filesystem at mountpoint (default is /proc/sys/fs/binfmt_misc). It also implies creating a new mount namespace since the binfmt_misc mount would otherwise mess up existing programs on the system. The new binfmt_misc filesystem is explicitly mounted as private (with MS_PRIVATE|MS_REC). --map-user | . , . --user. --map-users -:-:|auto|subids|all - - - -. newuidmap(1) unshare . - --map-user, ,," . . --map-users - . auto - /etc/subuid - 0. subids . all . --user. ,,util-linux" 2.39, outeruid,inneruid,count, /proc/[]/_ X-mount.idmap . --map-group | . , . --setgroups=deny --user. --map-groups -::|auto|subids|all - - - -. newgidmap(1) unshare . - --map-group, ,," . . --map-groups - . auto - /etc/subgid - 0. subids . all . --user. ,,util-linux" 2.39, outegid,innergid,count, /proc/[]/_ X-mount.idmap . --map-auto - /etc/subuid - 0. , - /etc/subgid - 0. - - . --map-users=auto --map-groups=auto. --map-subids - /etc/subuid. , - /etc/subgid. --map-users=subids --map-groups=subids. -r, --map-root-user - . ( ) . , , - -. --setgroups=deny --user. --map-user=0 --map-group=0. -c, --map-current-user - . --setgroups=deny --user. --map-user=$(id -ru) --map-group=$(id -rg). --owner uid:gid Set the owner user and group when creating a user namespace. These determine which user in the parent namespace has CAP_SYS_ADMIN in the new child namespace and can setns(2) into it. This option allows a privileged user to create a namespace on behalf of an unprivileged one, using its privileges to map ids and/or bind mount the namespace into the filesystem. It implies --user. --propagation private|shared|slave|unchanged . private. unchanged. (--mount) . --setgroups allow|deny setgroups(2) . setgroups(2), CAP_SETGID. 3.19 : setgroups(2) (/proc/*/_*) . setgroups(2) (. allow, ), setgroups(2) ( deny). -R, --root . -w, --wd . -S, --setuid . -G, --setgid . -l, --load-interp ,,binfmt_misc" ( --mount-binfmt). string ,,:name:type:offset:magic:mask:interpreter:flags". ,,https://www.kernel.org/doc/Documentation/admin-guide/binfmt-misc.rst". ,,F" ,,flags" --root , ,,binfmt_misc" , ,,chroot" ,,chroot" . --monotonic CLOCK_MONOTONIC . --time. --boottime CLOCK_BOOTTIME . --time. -h, --help . -V, --version . ,,proc" ,,sysfs" . , ,,proc" ,,sysfs" . , --fork ( ) 1. --mount-proc proc(5) . readlink(1) , . # unshare --fork --pid --mount-proc readlink /proc/self 1 , - : $ id -u; id -g 1000 1000 $ unshare --user --map-root-user \ sh -c 'whoami; cat /proc/self/uid_map /proc/self/gid_map' root 0 1000 1 0 1000 1 , 65536 - , - . - subuid(5) subgid(5). - 1 - 1 . , - : $ id -u 1000 $ cat /etc/subuid 1000:100000:65536 $ unshare --user --map-auto --map-root-user # id -u 0 # cat /proc/self/uid_map 0 1000 1 1 100000 65535 # touch file; chown 1:1 file # ls -ln --time-style=+ file -rw-r--r-- 1 1 1 0 file # exit $ ls -ln --time-style=+ file -rw-r--r-- 1 100000 100000 0 file UTS . nsenter(1) ; UTS unshare. . # touch /root/uts-ns # unshare --uts=/root/uts-ns hostname FOO # nsenter --uts=/root/uts-ns hostname FOO # umount /root/uts-ns /root/namespace/mnt. , (/root/namespaces) shared. # mount --bind /root/namespaces /root/namespaces # mount --make-private /root/namespaces # touch /root/namespaces/mnt # unshare --mount=/root/namespaces/mnt --kill-child , unshare , . # set +m # # unshare --pid --fork --mount-proc --kill-child -- \ bash --norc -c '(sleep 555 &) && (ps a &) && sleep 999' & [1] 53456 # 1 pts/3 S+ 0:00 sleep 999 3 pts/3 S+ 0:00 sleep 555 5 pts/3 R+ 0:00 ps a # ps h -o 'comm' $! # ,,unshare(1)" unshare # kill $! # ,,unshare(1)" # pidof sleep pidof(1) , sleep . , sleep 1 (. ) , . , --kill-child unshare , : # unshare --pid --fork --mount-proc -- \ bash --norc -c '(sleep 555 &) && (ps a &) && sleep 999' & [1] 53479 # 1 pts/3 S+ 0:00 sleep 999 3 pts/3 S+ 0:00 sleep 555 5 pts/3 R+ 0:00 ps a # kill $! # pidof sleep 53482 53480 : # uptime -p # ,,uptime" up 21 , 30 # unshare --time --fork --boottime 300000000 uptime -p up 9 , 28 , 1 , 2 , 50 The following example executes a chroot into the directory /chroot/powerpc/jessie and installs the interpreter /bin/qemu-ppc-static to execute the powerpc binaries. $ unshare --map-root-user --fork --pid --load-interp=":qemu-ppc:M::\\x7fELF\x01\\x02\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x14:\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xfe\\xff\\xff:/bin/qemu-ppc-static:OCF" --root=/chroot/powerpc/jessie /bin/bash -l ,,load-interp" ,,qemu-ppc" ,,/proc/sys/fs/binfmt_misc" ,,M" ,,\\x7fELF\x01\\x02\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x1" ( , ELF PPC32) ,,\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xfe\\xff\\xff" ,,/bin/qemu-ppc-static" ,,OCF" . Mikhail Gusarov , Karel Zak newuidmap(1), newgidmap(1), nsenter(1), lsns(8), clone(2), unshare(2), namespaces(7), mount(8) , ,,https://github.com/util-linux/util-linux/issues[issue tracker]". unshare ,,util-linux" . util-linux 2.42.2 2026-06-16 UNSHARE(1)