https://nalar.dev/tags/filesystem-isolation/ Recent content in Filesystem Isolation on Nalar Hugo en-us Fri, 18 Sep 2026 00:00:00 +0000 https://nalar.dev/mount-propagation-defines-the-filesystem-boundary-between-linux-mount-namespaces/ Fri, 18 Sep 2026 00:00:00 +0000 https://nalar.dev/mount-propagation-defines-the-filesystem-boundary-between-linux-mount-namespaces/ <p>A process can enter a new Linux mount namespace and still observe a later mount created elsewhere. The namespace boundary is intact: the process has its own mount table. The new mount appears because some mounts in the two namespaces remain connected by propagation relationships.</p> <p>This distinction matters in container runtimes, service sandboxes, build systems, and privileged helpers. Creating a mount namespace separates the namespace&rsquo;s view of the mount table, but it does not by itself make every future mount event local. Shared-subtree state determines whether mount and unmount events cross that boundary.</p>