I have created a container with "systemd-nspawn" command. Inside that container, with "route" command I could get ip address of default gateway and could ping it. Now, "ps -ecf" in the host system (outside container) shows "ping" process.

man page of "systemd-nspawn" says it virtualises process tree, the various IPC subsystems and the host and domain name.

my dought is, if "systemd-nspawn" virtualises process tree, why am i seeing "ping " process in "ps -ecf" outside the container??

I could also observe this in reverse case i.e "ping" from host and "ps -ecf " inside container.


1) create container and ping:
directory chroot in below command has a debian image obtained from "debootsrtap"

root@vig-debian:/home/vignesh/docker_tutorials# systemd-nspawn -D chroot
Spawning container chroot on /home/vignesh/docker_tutorials/chroot.
Press ^] three times within 1s to kill container.
/etc/localtime is not a symlink, not updating container timezone.
root@chroot:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default UG 1024 0 0 eth0 * UH 1024 0 0 eth0 * U 0 0 0 eth0
root@chroot:~# ping
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=63 time=0.322 ms
64 bytes from icmp_seq=2 ttl=63 time=0.440 ms

2) "ps " in host

root@vig-debian:/home/vignesh/docker_tutorials# ps -ecf | grep "ping"
root 3460 3452 TS 19 16:49 pts/1 00:00:00 ping
root 3462 2493 TS 19 16:49 pts/2 00:00:00 grep ping
root@vig-debian:/home/vignesh/docker_tutorials# machinectl
chroot container nspawn

1 machines listed.


The host can see and send signal to all container processes.

Doing the test from two containers you will see that the processes are not visible.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.