What specific Linux namespace types exist, and what does each one actually isolate for a containerized process?

Linux provides eight namespace types, each isolating one specific kind of system resource: PID (process IDs — a container's process sees itself as PID 1 with its own process tree), Network (network interfaces, routing tables, ports), Mount (filesystem mount points), UTS (hostname and domain name), IPC (inter-process communication resources like shared memory and message queues), User (user and group ID mappings), Cgroup (visibility into the cgroup hierarchy itself), and Time (per-namespace view of system clocks, the newest addition). A container typically uses all of them together, combined with cgroups for resource limiting, to produce the overall "looks like an isolated machine" experience.

Each namespace type isolates a specific, narrow slice of what a process can see or affect, and understanding them individually clarifies exactly what "container isolation" does and doesn't cover:

PID namespace: gives a process its own view of process IDs, starting from 1 — the first process in a new PID namespace becomes that namespace's "init" (PID 1), and processes inside can't see or signal processes outside the namespace. This is why a containerized process can appear as PID 1 while the host sees it as some arbitrary high-numbered PID in its own, outer PID namespace.

Network namespace: gives a process its own network interfaces, IP addresses, routing tables, and port space — a container can bind to port 80 without conflicting with something on the host also using port 80, because they're in separate network namespaces with entirely independent port spaces. Container networking (bridges, veth pairs) is built on connecting these isolated network namespaces back to the host or to each other.

Mount namespace: gives a process its own view of the filesystem mount table — this is what lets a container have its own root filesystem (from its image) that looks nothing like the host's filesystem, even though it's technically all backed by the same underlying storage.

UTS namespace: isolates hostname and NIS domain name, letting a container have its own hostname independent of the host machine's.

IPC namespace: isolates System V IPC objects and POSIX message queues (shared memory segments, semaphores), preventing a container from accessing another container's or the host's IPC resources.

User namespace: maps user and group IDs between the container's view and the host's — notably, this allows a process to be "root" (UID 0) inside its own user namespace while actually mapping to an unprivileged, non-root UID on the host, which is the mechanism behind rootless containers, a meaningful security improvement since a container-escape exploit lands on an unprivileged host user rather than genuine root.

Cgroup namespace: isolates a process's view of the cgroup hierarchy itself, so it sees its own cgroup as the root rather than the host's full cgroup tree.

Time namespace (the newest, added in Linux 5.6): allows a namespace to have its own view of certain system clocks — used for scenarios like container checkpoint/restore where a container's internal notion of uptime shouldn't jump when migrated between hosts.

Notably, what namespaces don't isolate is the kernel itself — every namespace still shares the same underlying kernel, which is exactly the isolation boundary that's fundamentally weaker than a VM's (as covered in the container-vs-VM comparison), since a kernel vulnerability can potentially be exploited across namespace boundaries in ways it can't across genuinely separate VM kernels.

• Each Linux namespace type isolates one specific resource: PID (process tree), Network (interfaces/ports), Mount (filesystem view), UTS (hostname), IPC (shared memory/queues), User (UID/GID mapping), Cgroup (cgroup hierarchy view), Time (clock view).
• A container typically combines all of them, plus cgroups for resource limiting, to produce the overall isolated-environment experience.
• The User namespace's UID mapping is the mechanism behind rootless containers — "root" inside the container maps to an unprivileged host user.
• None of the namespace types isolate the kernel itself — all containers on a host still share one kernel, which remains the fundamental isolation boundary weaker than a VM's.

• Linux man-pages: namespaces(7)
• Linux man-pages: user_namespaces(7)
• Linux man-pages: time_namespaces(7)