---
name: "vdens"
section: "1"
platform: "linux"
package: "vdens"
version: "0.2-2+b2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/vdens"
---

# vdens(1)

create a user namespace connected to a vde network

## NAME

vdens - create a user namespace connected to a vde network

## SYNOPSIS

**vdens** \[ options \] \[ *vde\_network* \[ *command* \[ *args* \] \] \]

**vdens** **-m** \[ options \] *vde\_network* \[ *vde\_network ...* \] \[ **--** *command* \[ *args* \] \]

**vdens** **--multi** \[ options \] *vde\_network* \[ *vde\_network ...* \] \[ **--** *command* \[ *args* \] \]

## DESCRIPTION

vdens creates a user namespace with a private network namespace.

Vdens launches the command indicated as a parameter ($SHELL if omitted) in a private network namespace.

If the vde\_network parameter is present (and it does not match one of the strings "-" or "no") the virtual private network namespace will have a virtual interface connected to the specified vde network.

Vdens grants the capabilities CAP\_NET\_BIND\_SERVICE, CAP\_NET\_BROADCAST, CAP\_NET\_ADMIN and CAP\_NET\_RAW to the command to permit the configuration of the virtual interface. The scope of these capabilities is limited to the user namespace created by vdens. Once the network has been configured, the capabilities can be dropped (e.g. using csdrop(1)) in order to increase the security (obeying to the principle of least privilege).

## OPTIONS

OPTIONS *vdens* accepts the following options.

- **-m** **--multi**

  **connect the vde namespace to one or more vde networks. A virtual interface is defined** **for each** *vde\_network*: **vde0** is connected to the first *vde\_network*, **vde1** is connected to the second and so on. (It is possible to use a different prefix for the interface names instead of "vde", see -i or --iface below).

- **-i** *interface\_prefix* **--iface** *interface\_prefix*

  *define the prefix of the interface name. For example use* **--iface eth** to name the interfaces "eth0", "eth1", etc.  (the default value is "vde")

- **-R** *ip\_addr(s)* **--resolvaddr** *ip\_addr(s)*

  *define the address (or addresses) of the domain name servers for the namespace.* *(multiple IPv4 or IPv6 addresses can be separated by commas, e.g. "-R 9.9.9.9,9.9.8.8")*

- **-r** *pathname* **--resolvconf** *pathname*

  *define the pathname of the file which will appear as /etc/config.sys in the user namespace.* *(it is ignored if used together with* **-R** or **--resolvaddr**)

- **-s** **--sysadm**

  **grant also CAP\_SYS\_ADMIN in the namespace so that it is possible to bind mount files and** **directories.**

- **-c** **--clone**

  **Use [clone(2)](/clone/2.md) to create the private network namespace. Vdens needs one more thread to manage** **the vde communication.**

- **-u** **--unshare**

  **Use [unshare(2)](/unshare/2.md) to create the private network namespace. It may not work if the vde plugin in use** **is multithreaded (e.g. slirp). If neither -c/--clone nor -u/--unshare is set, vdens tries** **unshare first and then it uses clone if unshare fails. (If both are set vdens uses clone).**

## ENVIRONMENT VARIABLES

- **VDE\_RESOLVCONF**

  **define the default value for the --resolvconf**  option

- **VDE\_RESOLVADDR**

  **define the default value for the --resolvaddr**  option

## NOTES

Use of user namespaces requires a kernel that is configured with the CONFIG\_USER\_NS option. In some distributions (e.g. Debian) user namespaces must be enabled by writing 1 to /proc/sys/kernel/unprivileged\_userns\_clone.

## SEE ALSO

[**vde\_plug**(1)](/vde_plug/1.md), [**cadrop**(1)](/cadrop/1.md), [**cado**(1)](/cado/1.md), [**capabilities**(7)](/capabilities/7.md)

## AUTHORS

Renzo Davoli \<renzo@cs.unibo.it\>, Davide Berardi \<berardi.dav@gmail.com\>.