When debugging a containerised application, you often need to inspect the internal state of a running container without installing additional tools inside it. The standard approach of executing a shell inside the container with docker exec works for containers that include a shell binary, but many production containers are built on minimal base images like scratch or distroless that contain no shell at all. The Linux nsenter command solves this problem by allowing you to enter the specific Linux namespaces of a running process directly from the host system, giving you full diagnostic access without modifying the container image.
How Linux Namespaces Isolate Containers
Containers are not virtual machines. They are ordinary Linux processes that have been isolated using kernel namespaces. Each container typically runs inside its own set of namespaces: a PID namespace (so it sees only its own processes), a network namespace (so it has its own network stack and IP address), a mount namespace (so it has its own filesystem view), and several others. The nsenter command allows you to step into one or more of these namespaces, effectively placing your terminal session inside the same isolated environment as the container’s main process.
What You Need Before Starting
The nsenter command is part of the util-linux package, which is installed by default on virtually all modern Linux distributions including Ubuntu, Debian, Fedora, and CentOS. You will need root privileges on the host machine because entering another process’s namespaces is a privileged operation. You will also need the Process ID (PID) of the container’s main process as seen from the host.
Finding the Container’s Host PID
Before you can use nsenter, you must determine the PID of the container’s init process on the host system.
If you are using Docker, run the following command, replacing my_container with your container’s name or ID:
docker inspect --format '{{.State.Pid}}' my_container
This will output a single number, such as 28451. This is the PID you will use with nsenter.
If you are using Podman, the command is identical:
podman inspect --format '{{.State.Pid}}' my_container
Entering All Namespaces of a Container
To fully enter a container’s environment (replicating what docker exec -it /bin/sh would do, but from the host), use the --all flag along with the --target flag pointing to the container’s PID.
sudo nsenter --all --target 28451
Replace 28451 with your container’s actual PID. You will be dropped into a shell where you can see the container’s filesystem, its process table, and its network interfaces exactly as the containerised application sees them.
Entering Specific Namespaces Only
Sometimes you do not need full access. For example, if you only want to inspect the container’s network configuration to diagnose a connectivity issue, you can enter just the network namespace:
sudo nsenter --net --target 28451
Once inside the network namespace, you can run host-installed tools like ip addr, ss -tlnp, or tcpdump to diagnose the container’s network traffic without needing those tools installed inside the container itself.
Other commonly used namespace flags include:
--pid— Enter the PID namespace to view the container’s process list.--mount— Enter the mount namespace to see the container’s filesystem mounts.--ipc— Enter the IPC namespace to inspect shared memory segments.
Practical Debugging Recommendations
The major advantage of nsenter over docker exec is that you can use any diagnostic tool installed on the host operating system, regardless of what is inside the container image. This is invaluable for debugging distroless containers, which deliberately exclude shells and package managers to minimise the attack surface. When you are finished diagnosing, simply type exit to leave the namespace and return to your normal host shell. No changes are made to the container image or its running state.