# man > cgroup_namespaces(7)

---
type: CommandReference
command: cgroup_namespaces
mode: man
section: 7
source: man-pages
---

## Quick Reference

- `unshare -Cm bash` — create new shell in new cgroup + mount namespace
- `cat /proc/self/cgroup` — view own cgroup memberships (relative to namespace root)
- `cat /proc/1/cgroup` — view init process cgroup (shows `../` for ancestors)
- `mount --make-rslave /` — prevent mount propagation to other namespaces
- `umount /sys/fs/cgroup/freezer` — unmount cgroup filesystem
- `mount -t cgroup -o freezer freezer /sys/fs/cgroup/freezer` — remount in new namespace
- `cat /proc/self/mountinfo | grep freezer` — verify mount root after remount
- `echo PID > /sys/fs/cgroup/freezer/sub/cgroup.procs` — move process to cgroup

## Name

cgroup_namespaces — overview of Linux cgroup namespaces

## Synopsis

Cgroup namespaces virtualize the view of a process's cgroups (see [cgroups(7)](https://www.chedong.com/phpMan.php/man/cgroups/7/markdown)) as seen via `/proc/[pid]/cgroup` and `/proc/[pid]/mountinfo`.

## Description

Each cgroup namespace has its own set of cgroup root directories. These roots become the base points for relative paths in `/proc/[pid]/cgroup`. When a process creates a new cgroup namespace using `clone(2)` or `unshare(2)` with `CLONE_NEWCGROUP`, its current cgroups directories become the namespace roots (for both cgroups v1 hierarchies and the v2 unified hierarchy).

When reading the cgroup memberships of a target process from `/proc/[pid]/cgroup`, the pathname shown is relative to the reading process's root directory. If the target process's cgroup directory lies outside the reader's root, the pathname will show `../` entries for each ancestor level.

The virtualization provides:
- **Information leak prevention** — container processes cannot see cgroup directory paths outside the container.
- **Easier container migration** — avoids needing to replicate full cgroup pathnames on the target system.
- **Better confinement** — containerized processes can be prevented from modifying ancestor cgroup directories (e.g., a process in `/cg/1/2` cannot see or modify `/cg/1`).

## Examples

shell
# (as superuser) Create child cgroup, place a process in it
mkdir -p /sys/fs/cgroup/freezer/sub2
sleep 10000 &
echo 20124 > /sys/fs/cgroup/freezer/sub2/cgroup.procs

# Create another child cgroup, move shell into it
mkdir -p /sys/fs/cgroup/freezer/sub
echo $$ > /sys/fs/cgroup/freezer/sub/cgroup.procs
cat /proc/self/cgroup | grep freezer
# 7:freezer:/sub

# Create new cgroup + mount namespace
PS1="sh2# " unshare -Cm bash

# In new shell, inspect cgroup memberships
cat /proc/self/cgroup | grep freezer
# 7:freezer:/
cat /proc/1/cgroup | grep freezer
# 7:freezer:/..
cat /proc/20124/cgroup | grep freezer
# 7:freezer:/../sub2

# Remount cgroup filesystem to fix mountinfo
mount --make-rslave /
umount /sys/fs/cgroup/freezer
mount -t cgroup -o freezer freezer /sys/fs/cgroup/freezer
cat /proc/self/mountinfo | grep freezer
# 155 145 0:32 / /sys/fs/cgroup/freezer rw,relatime ...
## See Also

[unshare(1)](https://www.chedong.com/phpMan.php/man/unshare/1/markdown), [clone(2)](https://www.chedong.com/phpMan.php/man/clone/2/markdown), [setns(2)](https://www.chedong.com/phpMan.php/man/setns/2/markdown), [unshare(2)](https://www.chedong.com/phpMan.php/man/unshare/2/markdown), [proc(5)](https://www.chedong.com/phpMan.php/man/proc/5/markdown), [cgroups(7)](https://www.chedong.com/phpMan.php/man/cgroups/7/markdown), [credentials(7)](https://www.chedong.com/phpMan.php/man/credentials/7/markdown), [namespaces(7)](https://www.chedong.com/phpMan.php/man/namespaces/7/markdown), [user_namespaces(7)](https://www.chedong.com/phpMan.php/man/user_namespaces/7/markdown)

## Conforming To

Namespaces are a Linux-specific feature. Use requires `CONFIG_CGROUPS`.