> For the complete documentation index, see [llms.txt](https://gitbook.cdxiaodong.life/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.cdxiaodong.life/rong-qi-an-quan/tao-yi-ji-shu/pid-namespace-sharing.md).

# PID命名空间共享

## 概述

PID命名空间在进程之间提供分离。它防止系统进程可见，并允许重用进程ID，包括PID 1。如果主机的PID命名空间与容器共享，这将允许它们查看主机系统上的所有进程。

如果PID命名空间被共享，这意味着：

* 容器进程不再有PID 1。一些容器拒绝在没有PID 1的情况下启动（例如，使用`systemd`的容器）或运行如`kill -HUP 1`之类的命令来信号容器进程。在具有共享进程命名空间的Kubernetes Pod中，`kill -HUP 1`将信号Pod沙箱。
* 主机进程（或Pod中容器的进程）对容器（或其他容器）可见。这包括`/proc`中可见的所有信息，例如作为参数或环境变量传递的机密信息。这些仅受常规Unix权限保护。
* 主机（或容器）文件系统通过`/proc/[pid]/root`链接对容器（或Pod中的其他容器）可见。

PID命名空间共享减少了主机和容器之间的进程级隔离，并使各种攻击成为可能，包括注入到主机进程（需要[CAP\_SYS\_PTRACE](/rong-qi-an-quan/tao-yi-ji-shu/excessive-capabilities.md#cap_sys_ptrace)）。

## 参考资料

* [tbhaxor：容器突破 – 第1部分（实验：进程注入）](https://tbhaxor.com/container-breakout-part-1/)
* [#BrokenSesame：私有注册表的意外'写'权限允许对阿里云数据库服务进行潜在RCE](https://www.wiz.io/blog/brokensesame-accidental-write-permissions-to-private-registry-allowed-potential-r)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://gitbook.cdxiaodong.life/rong-qi-an-quan/tao-yi-ji-shu/pid-namespace-sharing.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.