Troubleshooting containers from the host with lsns and nsenter

Goal

Diagnose a container's network (or other namespace-scoped) state using ordinary host tools, without needing those tools installed inside a minimal container image.

Prerequisites

Root on the host (entering another process's namespaces requires privileges over that process, and network/mount namespace operations need CAP_SYS_ADMIN in practice); nsenter and lsns from util-linux, normally already present.

Steps

1. List namespaces on the host: lsns prints every namespace instance, its type (net, mnt, pid, uts, ipc, user, cgroup, time), owning process and command; add -t net to show only network namespaces. This gives a host-wide inventory independent of which container engine created them.
2. Find a specific container's PID from the host: for Docker, docker inspect --format '{{.State.Pid}}' <container>; for Podman, podman inspect --format '{{.State.Pid}}' <container> (for a rootless container, run it as the owning user, then nsenter as root). This PID is the container's namespace anchor as seen from the host.
3. Confirm which namespaces that PID belongs to: lsns -p <pid>, or read /proc/<pid>/ns/ directly — each entry is a symlink whose target (an inode number plus namespace type) identifies the namespace, as documented for the /proc/[pid]/ns/ files.
4. Enter only the network namespace to run diagnostics with host tools: nsenter -t <pid> -n ss -tulpn or nsenter -t <pid> -n ip addr show. -n (or --net) attaches to the target process's network namespace for the duration of the command, without touching its mount or PID namespace.
5. Enter several namespaces when needed, e.g. network plus UTS with nsenter -t <pid> -n -u sh -c 'hostname; ip route', or all of them with -a. Once the mount namespace is entered (-m, or -a), the program is resolved in the container's filesystem, not the host's: nsenter -t <pid> -m -n /bin/sh runs the container's own /bin/sh and fails in images that have none. To keep using host binaries, leave out -m; if no program is given, nsenter runs $SHELL.
6. Exit the shell or let the one-shot command finish; this does not affect the container's own processes, which keep running throughout.

Expected result

ss/ip output shows exactly the sockets and interfaces visible inside the container's network namespace, matching what ip addr run inside the container itself (if available) would show.

Limits and test basis

nsenter works on the PID as it is now; if the container restarts, look the PID up again, because the old PID and its namespaces may no longer exist or may belong to another process. A container using the host's network namespace directly (--net=host) has no separate network namespace to enter — lsns will show it sharing the host's.