# Linux: users, namespaces and delegates

Attribute the actual socket and inspect kernel packet paths.

Updated: 2026-11-05
Canonical: https://shortant.ai/en/guides/platform-linux/

Adapted from Public Network Protection Guide 3.0.1. Read-only review first; no universal executable configuration is supplied.

## Match the execution boundary

Distinguish native Linux, containers, VMs and remote hosts. Record effective users, namespaces, firewall manager ownership, service sockets and privileged delegates. A user socket match does not automatically cover a changed identity, shared resolver or forwarded traffic.

Review output, forwarding, NAT, TUN and established-connection behavior. Never flush the machine’s rules as a shortcut. Keep the proxy and maintenance identities outside the protected workload denial.

## Delegation and recovery

An unrestricted container socket, privileged helper or host delegate can escape the intended boundary. Package managers under another identity require separate handling. Verify every actual execution location.

Use the installed manager’s scoped transaction and a tested recovery plan. Unknown delegation or startup paths remain explicit gaps; this page provides no universal shell commands.

## Sources and scope

- [Linux kernel networking documentation](https://docs.kernel.org/networking/)

Independent educational adaptation; vendor documents retain their owners’ rights. Check the installed version and applicability. Browser scores do not verify local isolation, account access or ban risk.