When working with Linux network namespaces, developers often need to execute commands in both custom and default namespaces. While ip netns exec makes it easy to enter custom namespaces, returning to the default namespace isn't as straightforward.

The fundamental issue stems from how the default namespace is represented in the system:

• Custom namespaces appear as files in /var/run/netns/
• The default namespace has no persistent representation
• ip netns identify returns empty for the default namespace

Here are several approaches to execute commands in the default namespace from within a custom namespace:

Method 1: Using nsenter with Root Process

# Get PID of a process in default namespace (e.g., init)
DEFAULT_PID=$(pgrep -o systemd || echo 1)

# Execute command in default namespace
nsenter -t $DEFAULT_PID -n your_command

Method 2: Persistent Default Namespace Reference

# Create reference to default namespace
touch /var/run/netns/default
mount --bind /proc/1/ns/net /var/run/netns/default

# Now you can use it like any other namespace
ip netns exec default your_command

Method 3: SSH Server in Separate Namespace

For your specific SSH server scenario:

# Create the test namespace
sudo ip netns add test_ns

# Start SSH server in the test namespace
sudo ip netns exec test_ns /usr/sbin/sshd -D -p 2222 &

# From SSH session, execute in default namespace:
ssh -p 2222 localhost 'nsenter -t 1 -n bash -c "your_command"'

When implementing these solutions:

• Some methods require root privileges
• Be mindful of PID 1's network namespace (it might not always be the default)
• For production systems, consider using proper service files
• Namespace references may need maintenance after reboots

For more complex scenarios, you can create a communication channel between namespaces:

# In default namespace:
socat TCP-LISTEN:1234 EXEC:bash &

# In test namespace:
ip netns exec test_ns socat TCP:127.0.0.1:1234 -

When working with Linux network namespaces, developers often need to execute commands in both custom and default namespaces. While ip netns exec makes it easy to enter custom namespaces, returning to the default namespace isn't as straightforward.

The default network namespace isn't represented in /var/run/netns like custom namespaces are. This is because the default namespace is the initial network environment created at system boot.

# Check current namespace (returns empty if in default namespace)
ip netns identify $$

Method 1: Using nsenter

The most reliable way to access the default namespace is using the nsenter command:

# Get PID of a process in default namespace (like init)
DEFAULT_PID=$(pgrep -o systemd || echo 1)

# Execute command in default namespace
nsenter -t $DEFAULT_PID -n your_command

Method 2: Persistent SSH Connection

For your specific SSH server scenario:

# Create helper script
cat << 'EOF' > /usr/local/bin/default-ns
#!/bin/bash
DEFAULT_PID=$(pgrep -o systemd || echo 1)
nsenter -t $DEFAULT_PID -n "$@"
EOF
chmod +x /usr/local/bin/default-ns

# Then users can run commands in default namespace via:
default-ns your_command

For more complex scenarios, you might want to create a transparent wrapper:

# Create transparent namespace switching function
function dnsexec() {
    local command="$@"
    if ip netns identify $$ &>/dev/null; then
        DEFAULT_PID=$(pgrep -o systemd || echo 1)
        nsenter -t $DEFAULT_PID -n $command
    else
        $command
    fi
}

# Example usage:
dnsexec ping google.com

When implementing namespace switching in a SSH server environment:

• Restrict namespace switching to authorized users only
• Consider using capabilities instead of full root access
• Audit all commands that can be executed in the default namespace

To verify namespace operations:

# Show network interfaces in current namespace
ip link show

# Compare with default namespace
nsenter -t 1 -n ip link show