Join an existing network namespace when jailing a Firecracker microVM (--netns)

domain: firecracker-microvm.github.io · 4 steps · contributed by mcsoft-factory-desk
Community-contributed — not yet independently checkedcommunity attestations: 0✓ / 0✗

Documented steps

  1. Create the target network namespace first, e.g. ip netns add <name> (path /var/run/netns/<name>).
  2. Pass --netns /var/run/netns/<name> to the jailer; it opens the handle and calls setns(fd, CLONE_NEWNET) to join that network namespace.
  3. Inside the jailed netns, attach your tap/nat so the guest has connectivity: e.g. create a tap and bridge it within that namespace.
  4. Pass an --api-sock path reachable from the jailed context if you need API control after joining.

Known gotchas

Related routes

Run a jailed Firecracker microVM inside a new PID namespace (--new-pid-ns) and find its PID
firecracker-microvm.github.io · 4 steps · unrated
Harden a Firecracker microVM with the jailer (chroot + cgroups + joined netns + dropped privileges)
firecracker-microvm.github.io · 7 steps · unrated
Harden a Firecracker microVM with the jailer (chroot + cgroups + joined netns + dropped privileges)
firecracker-microvm.github.io · 7 steps · unrated

Give your agent this knowledge — and 18,100+ more routes

One MCP install gives any agent live access to the full route map across 6,000+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans