From 328a031d64e52759104e33fffdfb19889c4dbb72 Mon Sep 17 00:00:00 2001 From: Simon Ruderich Date: Wed, 15 Jul 2026 07:56:12 +0200 Subject: [PATCH] README: document howto run in unprivileged user namespace --- README.adoc | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/README.adoc b/README.adoc index b5afc37..3c258fa 100644 --- a/README.adoc +++ b/README.adoc @@ -18,6 +18,7 @@ node. It is licensed under GPLv3+. - Linux compiled with `CONFIG_NET_NS` (available on most modern systems) - iproute2 (`ip`) +- root (or unprivileged user namespaces, see below) == Build @@ -105,6 +106,34 @@ https://en.wikipedia.org/wiki/DOT_(graph_description_language)[DOT] file: image::examples/readme/lab.png[DOT style diagram of network nodes and links] +=== Running without root using unprivileged user namespaces + +Creating a named network namespace within a user namespace requires a few +extra steps. Use the following commands: + + $ unshare --user --net --mount --map-auto --map-root-user + # mount -t tmpfs tmpfs /run + # mount -t tmpfs tmpfs /etc/netns + # export PATH=$PATH:/usr/sbin + +The tmpfs mounts make the directories writable within the user namespace. The +PATH is updated to ensure `sysctl` is found. + +To run the bird-ospf example: + + # mkdir /run/bird + # lnnl up examples/bird-ospf/lab.conf + [...] + # ip netns exec r1 ip -br a + [...] + # birdc -s /run/bird/r1.ctl + [...] + +To enter the namespace from another terminal (get the PID with `echo $$`): + + $ nsenter --user --net --mount --target $pid + + == Examples Have a look at `examples/`, which also includes running -- 2.55.0