Linux Namespace and cgroup Fundamentals: How Containers Really Work

SEO Metadata

SEO Title Options

1. Linux Namespace and cgroup Fundamentals: How Containers
2. Linux Namespace and cgroup Fundamentals: Practical 2026
3. Administration Playbook: Linux Namespace and cgroup

Meta Description Options

1. Learn Linux Namespace and cgroup Fundamentals: How Containers Really Work with a practical Administration framework, expert mistakes, implementation steps.
2. Explores PID, network, mount, UTS, IPC, and user namespaces, linking them to cgroups to show the foundations of container isolation.

URL Slug

linux-namespace-cgroup-fundamentals-how-containers-really-work

Focus Keyword

Linux Namespace and cgroup Fundamentals: How Containers Really Work

Additional LSI Keywords

• Administration
• Linux
• Containers
• Namespaces
• cgroups
• Isolation
• Linux Namespace and cgroup Fundamentals: How Containers Really Work
• production checklist
• implementation guide
• best practices
• architecture decisions
• testing strategy

Table of Contents

• Article overview
• What Linux Namespace and cgroup Fundamentals: How Containers Really Work means
• Why it matters now
• Implementation framework
• Practical comparison
• Expert workflow
• Common mistakes
• Media and link plan
• Original technical deep dive
• FAQ
• Structured data
• Conclusion

Article overview

Linux Namespace and cgroup Fundamentals: How Containers Really Work is the kind of topic that looks simple until it reaches production. Teams usually discover the real cost late: unclear boundaries, weak defaults, hidden maintenance work, and decisions that seemed harmless when the codebase was small.

The problem gets worse when the article, tutorial, or implementation guide only explains the happy path. This guide closes that gap with a practical framework, a comparison table, common mistakes, and a deep technical section you can use while planning real work.

Keep reading for the non-obvious part: the safest implementation is rarely the most impressive-looking one. It is the one your team can debug, test, document, and evolve without turning every future change into archaeology.

Key Takeaways

• Linux Namespace and cgroup Fundamentals: How Containers Really Work should be evaluated as a production decision, not only as a syntax or tooling choice.
• The best implementation keeps responsibilities visible, with clear ownership, tests, documentation, and rollback paths.
• Search visibility improves when practical depth, structured answers, and expert examples live on the same page.

[IMAGE: A mobile-first technical article layout showing the main concept, decision table, implementation checklist, and FAQ blocks. Alt: Linux Namespace and cgroup Fundamentals: How Containers Really Work expert guide for Administration]

What Linux Namespace and cgroup Fundamentals: How Containers Really Work means

Linux Namespace and cgroup Fundamentals: How Containers Really Work means applying administration knowledge to a concrete engineering decision, then turning that decision into reliable code, documentation, and operational behavior. In practice, it combines the topic's core concepts with trade-off analysis, implementation boundaries, testing strategy, and maintenance discipline.

This is the definition worth optimizing for featured snippets because it avoids hype. It tells the reader what the topic does and what a professional implementation must include.

Why it matters now

The technical web is more crowded than it was a few years ago. Thin tutorials can still get indexed, but they rarely earn trust from senior developers, buyers, AI answer systems, or teams that need production guidance.

For administration topics, the strongest content now has three layers:

• a clear answer for fast scanning
• a practical framework for implementation
• expert context that explains what breaks later

That same structure helps search engines understand the page. It also helps readers decide whether the advice fits their project.

Implementation framework

Use this framework before adopting the approach described in this article.

1. Define the user problem and the production risk.
2. Identify the smallest reliable implementation boundary.
3. Keep configuration, secrets, and environment-specific behavior outside the article's core logic.
4. Add tests for the behavior that would hurt if it regressed.
5. Document the trade-off, not only the final code.
6. Measure the result with logs, metrics, or user-facing outcomes.
7. Revisit the decision after real usage exposes edge cases.

The sequence is deliberately conservative. It keeps the work grounded in outcomes instead of novelty.

[IMAGE: A seven-step implementation framework with discovery, boundary design, configuration, tests, documentation, measurement, and iteration. Alt: Linux Namespace and cgroup Fundamentals: How Containers Really Work implementation framework]

Practical comparison

This table is intentionally practical. It gives a reviewer something to check before the implementation becomes expensive to change.

Expert workflow

Expert tip: "Treat Linux Namespace and cgroup Fundamentals: How Containers Really Work as a system boundary. If the next developer cannot find where the decision lives, how it is tested, and when it should be avoided, the implementation is not finished."

A useful workflow is simple:

• Start with the smallest working example.
• Add the constraints that exist in your real project.
• Remove anything that only demonstrates cleverness.
• Write down the failure modes.
• Add links to related decisions so future readers can navigate the topic cluster.

That last point matters for both humans and search systems. A single article can answer a question; a cluster proves authority.

Common mistakes

Mistake 1: Copying a pattern without its context

A pattern that works in a small demo can fail in a real application. The missing context is usually data volume, team experience, deployment process, security requirements, or observability.

Before copying the pattern, ask what assumption made it safe in the original example.

Mistake 2: Putting business logic in the wrong layer

This is the fastest way to make future debugging expensive. In Laravel, PHP, and server-rendered websites, presentation should receive prepared data, not discover rules on its own.

Keep decision logic in models, actions, services, policies, requests, jobs, or documented helpers where it can be tested directly.

Mistake 3: Optimizing for novelty instead of maintainability

Newer tools and language features can be valuable. They can also hide simple behavior behind unfamiliar syntax.

Use the option that makes the next production incident easier to understand.

Mistake 4: Publishing without a measurement plan

If the article describes a performance, SEO, security, or architecture improvement, define how success will be checked. Logs, tests, crawl diagnostics, analytics, and user behavior are all stronger than assumptions.

[IMAGE: A common-mistakes board with context loss, wrong layer, novelty bias, and missing measurement highlighted. Alt: Linux Namespace and cgroup Fundamentals: How Containers Really Work common mistakes]

Media and link plan

Image placeholders

• [IMAGE: A concept diagram for Linux Namespace and cgroup Fundamentals: How Containers Really Work with input, decision boundary, implementation, tests, and production feedback. Alt: Linux Namespace and cgroup Fundamentals: How Containers Really Work concept diagram]
• [IMAGE: A mobile screenshot-style checklist for Linux Namespace and cgroup Fundamentals: How Containers Really Work. Alt: Linux Namespace and cgroup Fundamentals: How Containers Really Work mobile checklist]
• [IMAGE: A comparison table visualization for strong versus weak implementation choices. Alt: Linux Namespace and cgroup Fundamentals: How Containers Really Work comparison table]

Video placeholder

[VIDEO: Insert a 5-8 minute YouTube walkthrough that demonstrates the main decision, the implementation boundary, the test strategy, and the production caveats for Linux Namespace and cgroup Fundamentals: How Containers Really Work.]

Trustworthy outbound links

• Linux manual pages - use this as the trust reference for operating-system reference.
• Google Search quality guidance - use this as the trust reference for people-first content and E-E-A-T alignment.

Internal linking opportunities

• Internal guide: Linux Resource Limits: ulimit, cgroups v2 - use this when readers need a related Administration follow-up.
• Internal guide: Linux Time Synchronization: Configuring NTP - use this when readers need a related Administration follow-up.

Original Technical Deep Dive

The short version

A Linux container is not a small virtual machine. It is a normal group of Linux processes started with several kernel isolation and control features around it.

The core pieces are:

The container runtime does roughly this:

prepare root filesystem
create namespaces
connect networking
place process in cgroup
drop privileges and capabilities
apply seccomp and LSM policy
exec the container process

Namespaces answer "what can this process see?" Cgroups answer "how much can this process use?" You need both.

Install inspection tools

On Debian or Ubuntu:

sudo apt update
sudo apt install -y util-linux iproute2 procps strace psmisc

On Fedora, RHEL, Rocky Linux, or AlmaLinux:

sudo dnf install -y util-linux iproute procps-ng strace psmisc

Useful commands:

lsns
nsenter
unshare
readlink
findmnt
ip netns
systemd-cgls
systemd-cgtop
systemd-run

Most namespace and cgroup examples require root. Some user namespace examples can run unprivileged when the distribution allows unprivileged user namespaces.

Inspect your current namespaces

Every process has namespace handles under /proc/<pid>/ns.

Inspect the current shell:

ls -l /proc/$$/ns

Example shape:

cgroup -> cgroup:[4026531835]
ipc -> ipc:[4026531839]
mnt -> mnt:[4026531841]
net -> net:[4026531840]
pid -> pid:[4026531836]
user -> user:[4026531837]
uts -> uts:[4026531838]

The number inside brackets is the namespace inode. Two processes are in the same namespace when their matching namespace symlinks point to the same inode.

Compare two processes:

readlink /proc/1/ns/mnt
readlink /proc/$$/ns/mnt

List namespaces system-wide:

lsns
lsns -t mnt
lsns -t net
lsns -p $$

Find a process tree and its namespace IDs:

ps -eo pid,ppid,user,comm --forest | head -40
lsns -p 1

This is the first debugging rule: a container is just one or more processes with different namespace handles and cgroup membership.

Know the namespace types

Common container namespaces:

This article focuses on PID, network, mount, UTS, IPC, user namespaces, and cgroups. Time namespaces and cgroup namespaces are useful, but they are not the first concepts to learn.

UTS namespace: hostname isolation

UTS is the easiest namespace to see.

Start a shell with a new UTS namespace:

sudo unshare --uts --fork bash

[IMAGE: Supporting visual 1 for Linux Namespace and cgroup Fundamentals: How Containers Really Work, showing Linux Namespace and cgroup Fundamentals: How Containers Really Work decisions, examples, and Linux, Containers, Namespaces. Alt: Linux Namespace and cgroup Fundamentals: How Containers Really Work linux-namespace-cgroup-fundamentals-how-containers-really-work visual 1]

[IMAGE: Supporting visual 1 for Linux Namespace and cgroup Fundamentals: How Containers Really Work, showing Linux Namespace and cgroup Fundamentals: How Containers Really Work decisions, examples, and Linux, Containers, Namespaces. Alt: Linux Namespace and cgroup Fundamentals: How Containers Really Work linux-namespace-cgroup-fundamentals-how-containers-really-work visual 1]

Inside it:

hostname container-lab
hostname

In another terminal on the host:

hostname

The host hostname did not change. Only processes in the new UTS namespace see container-lab.

Inspect from inside:

readlink /proc/$$/ns/uts

Exit:

exit

Containers use this so hostname inside the container can be different from the host.

PID namespace: process ID isolation

A PID namespace gives children a separate PID number space. The first process created inside the namespace becomes PID 1 inside that namespace.

Run:

sudo unshare --pid --fork --mount-proc bash

Inside:

echo $$
ps -ef
readlink /proc/$$/ns/pid

You should see the shell as PID 1 inside the namespace.

The --mount-proc option matters. Without a matching /proc mount, tools such as ps can show confusing host information because /proc is still the host's procfs view.

From another terminal, find the host PID:

pgrep -a bash | grep unshare
lsns -t pid

The same process has one PID inside the namespace and another PID on the host.

Important PID namespace behavior:

• PID 1 inside the namespace has special signal and child-reaping responsibilities.
• If PID 1 exits, the namespace's process tree is torn down.
• A parent namespace can see processes in child PID namespaces.
• A child PID namespace cannot see arbitrary processes in the parent namespace.

That is why real container images should run a process that handles signals correctly, or use a minimal init such as tini when the application does not reap children.

Exit:

exit

Mount namespace: filesystem view

A mount namespace isolates the mount table. It does not automatically give you a new root filesystem. It only lets processes have a different set of mounts.

Create a lab directory:

sudo mkdir -p /tmp/ns-lab/inside

Start a shell in a new mount namespace:

sudo unshare --mount --fork bash

Inside it, make mount propagation private and mount a tmpfs:

mount --make-rprivate /
mount -t tmpfs tmpfs /tmp/ns-lab/inside
findmnt /tmp/ns-lab/inside
touch /tmp/ns-lab/inside/file-from-namespace
ls /tmp/ns-lab/inside

In another host terminal:

findmnt /tmp/ns-lab/inside
ls /tmp/ns-lab/inside

The host should not see the tmpfs mount from inside the namespace.

Exit and clean up:

exit
sudo rm -rf /tmp/ns-lab

Mount namespaces are why a container can see /bin, /etc, /app, and /proc from its own root filesystem layout while the host has a different mount table.

Important distinction:

mount namespace != chroot

chroot changes path resolution root for a process. A mount namespace isolates the mount table. Container runtimes normally combine mount namespaces, pivoting or changing root, bind mounts, read-only mounts, tmpfs mounts, and masked paths.

[IMAGE: Supporting visual 2 for Linux Namespace and cgroup Fundamentals: How Containers Really Work, showing Linux Namespace and cgroup Fundamentals: How Containers Really Work decisions, examples, and Linux, Containers, Namespaces. Alt: Linux Namespace and cgroup Fundamentals: How Containers Really Work linux-namespace-cgroup-fundamentals-how-containers-really-work visual 2]

Network namespace: network stack isolation

A network namespace has its own:

• interfaces;
• IP addresses;
• routes;
• socket port space;
• firewall rules;
• /proc/net;
• /sys/class/net.

[IMAGE: Supporting visual 2 for Linux Namespace and cgroup Fundamentals: How Containers Really Work, showing Linux Namespace and cgroup Fundamentals: How Containers Really Work decisions, examples, and Linux, Containers, Namespaces. Alt: Linux Namespace and cgroup Fundamentals: How Containers Really Work linux-namespace-cgroup-fundamentals-how-containers-really-work visual 2]

Create a temporary network namespace:

sudo ip netns add demo
sudo ip netns exec demo ip link
sudo ip netns exec demo ip route

Bring up loopback:

sudo ip -n demo link set lo up
sudo ip netns exec demo ip addr

Clean up:

sudo ip netns del demo

That namespace has no outside connectivity until you connect it with a veth pair, bridge, routing, and possibly NAT. The separate container networking article in this codebase goes deeper into veth pairs, bridges, forwarding, and iptables.

IPC namespace: shared memory and message queues

IPC namespaces isolate System V IPC objects and POSIX message queues.

On the host:

ipcs

Start a shell with a new IPC namespace:

sudo unshare --ipc --fork bash

Inside:

ipcs
ipcmk -M 1024
ipcs

In another host terminal:

ipcs

The host IPC listing should not show the object created inside the IPC namespace.

Exit:

exit

IPC namespaces matter for older applications that use shared memory segments, semaphore sets, or message queues. They also prevent unrelated containers from accidentally colliding on IPC object IDs.

User namespace: root inside is not root outside

User namespaces map UIDs and GIDs inside the namespace to different UIDs and GIDs outside it.

As an unprivileged user, try:

unshare --user --map-root-user bash

Inside:

id
cat /proc/self/uid_map
cat /proc/self/gid_map

Typical result:

uid=0(root) gid=0(root)
         0       1000          1

That means UID 0 inside the user namespace maps to UID 1000 outside. You appear to be root inside the namespace, but that does not make you host root.

User namespaces are the foundation of rootless containers. They also change capability checks. A process can have CAP_SYS_ADMIN inside its user namespace without having CAP_SYS_ADMIN in the initial host user namespace.

This is powerful and subtle:

• UID and GID ownership can look different inside and outside.
• Capabilities are scoped to a user namespace.
• Some kernel objects are owned by the user namespace that created them.
• File ownership mappings need subordinate ID ranges for realistic rootless containers.

Check subordinate ranges:

grep "^$(id -un):" /etc/subuid /etc/subgid

Exit:

exit

Do not treat user namespaces as a complete sandbox by themselves. They are one layer.

cgroup namespace: path view, not resource policy

[IMAGE: Supporting visual 3 for Linux Namespace and cgroup Fundamentals: How Containers Really Work, showing Linux Namespace and cgroup Fundamentals: How Containers Really Work decisions, examples, and Linux, Containers, Namespaces. Alt: Linux Namespace and cgroup Fundamentals: How Containers Really Work linux-namespace-cgroup-fundamentals-how-containers-really-work visual 3]

A cgroup namespace virtualizes the cgroup path view shown through files such as:

/proc/self/cgroup
/proc/self/mountinfo

Create one:

sudo unshare --cgroup --fork bash

Inside:

cat /proc/self/cgroup
readlink /proc/$$/ns/cgroup

This does not create a CPU or memory limit. It changes how the process sees cgroup paths. The resource policy still comes from the cgroup hierarchy and controllers.

Exit:

exit

cgroups: resource control, not visibility

Cgroups organize processes into a hierarchy and apply controllers to that hierarchy.

Check whether the host uses cgroups v2:

stat -fc %T /sys/fs/cgroup

Expected:

cgroup2fs

[IMAGE: Supporting visual 3 for Linux Namespace and cgroup Fundamentals: How Containers Really Work, showing Linux Namespace and cgroup Fundamentals: How Containers Really Work decisions, examples, and Linux, Containers, Namespaces. Alt: Linux Namespace and cgroup Fundamentals: How Containers Really Work linux-namespace-cgroup-fundamentals-how-containers-really-work visual 3]

Inspect the tree:

systemd-cgls
systemd-cgtop

Inspect the current shell's cgroup:

cat /proc/$$/cgroup

Inspect root cgroup controllers:

cat /sys/fs/cgroup/cgroup.controllers
cat /sys/fs/cgroup/cgroup.subtree_control

Common cgroups v2 files:

On a systemd host, do not manually rearrange service cgroups under /sys/fs/cgroup. Let systemd manage units and scopes.

Run a process in a limited cgroup

Use systemd-run --scope for a clean cgroup lab:

sudo systemd-run --scope \
  -p CPUAccounting=yes \
  -p CPUQuota=50% \
  -p MemoryAccounting=yes \
  -p MemoryMax=200M \
  -p TasksAccounting=yes \
  -p TasksMax=64 \
  bash

Inside the new shell:

cat /proc/$$/cgroup

In another terminal, find the scope:

systemd-cgls | grep -A5 run-
systemd-cgtop

Inspect the cgroup path from inside the shell:

CGROUP=$(cut -d: -f3 /proc/$$/cgroup)
cat /sys/fs/cgroup"$CGROUP"/cpu.max
cat /sys/fs/cgroup"$CGROUP"/memory.max
cat /sys/fs/cgroup"$CGROUP"/pids.max
cat /sys/fs/cgroup"$CGROUP"/memory.current

Exit the scoped shell:

exit

This is the cgroup part of a container: the process is still a normal process, but the kernel accounts and limits it inside a cgroup.

Put namespaces and cgroups together

Run a shell with several namespaces:

sudo systemd-run --scope \
  -p MemoryMax=200M \
  -p CPUQuota=50% \
  unshare --fork --pid --mount --uts --ipc --mount-proc bash

Inside:

hostname ns-lab
echo "pid=$$"
ps -ef
cat /proc/$$/cgroup
ls -l /proc/$$/ns

From another terminal:

lsns | grep ns-lab
systemd-cgtop

The shell has:

• a different PID namespace;
• a different mount namespace;
• a different UTS namespace;
• a different IPC namespace;
• a cgroup with CPU and memory policy.

It is still not a complete production container. It has no dedicated root filesystem, no configured network namespace, no dropped capability set, no seccomp profile, and no AppArmor or SELinux policy.

Exit:

exit

Inspect a real container

[IMAGE: Supporting visual 4 for Linux Namespace and cgroup Fundamentals: How Containers Really Work, showing Linux Namespace and cgroup Fundamentals: How Containers Really Work decisions, examples, and Linux, Containers, Namespaces. Alt: Linux Namespace and cgroup Fundamentals: How Containers Really Work linux-namespace-cgroup-fundamentals-how-containers-really-work visual 4]

If Docker is installed, start a temporary container:

docker run --rm -d --name ns-demo nginx:alpine

Get its host PID:

PID=$(docker inspect -f '{{.State.Pid}}' ns-demo)
echo "$PID"

Inspect namespaces:

sudo ls -l /proc/"$PID"/ns
sudo lsns -p "$PID"

Enter the network namespace:

sudo nsenter -t "$PID" -n ip addr
sudo nsenter -t "$PID" -n ip route

Enter the PID and mount namespaces:

sudo nsenter -t "$PID" -p -m ps -ef
sudo nsenter -t "$PID" -m findmnt | head

Inspect cgroup membership:

sudo cat /proc/"$PID"/cgroup

On a cgroups v2 host, the cgroup path points under /sys/fs/cgroup:

CGROUP=$(sudo awk -F: '{print $3}' /proc/"$PID"/cgroup)
sudo cat /sys/fs/cgroup"$CGROUP"/memory.current
sudo cat /sys/fs/cgroup"$CGROUP"/pids.current

Clean up:

docker stop ns-demo

The commands above show the same primitives used in the manual labs. Docker, containerd, CRI-O, and LXC automate setup and policy, but the kernel objects are still visible through /proc, namespace handles, and cgroup files.

Containers need more than namespaces and cgroups

Namespaces and cgroups are necessary, but not enough.

A secure runtime also needs:

• a minimal root filesystem;
• read-only mounts where possible;
• no unnecessary bind mounts from the host;
• a reduced Linux capability set;
• seccomp syscall filtering;
• AppArmor or SELinux policy;
• no privileged container mode for normal workloads;
• careful user namespace mappings for rootless workloads;
• explicit network policy;
• cgroup limits that match production capacity.

[IMAGE: Supporting visual 4 for Linux Namespace and cgroup Fundamentals: How Containers Really Work, showing Linux Namespace and cgroup Fundamentals: How Containers Really Work decisions, examples, and Linux, Containers, Namespaces. Alt: Linux Namespace and cgroup Fundamentals: How Containers Really Work linux-namespace-cgroup-fundamentals-how-containers-really-work visual 4]

Common bad assumptions:

Troubleshooting checklist

When a container isolation problem is unclear, inspect in this order:

1. Find the host PID of the container process.
2. Compare /proc/<pid>/ns/* with the host and expected peer processes.
3. Check /proc/<pid>/cgroup.
4. Inspect the matching files under /sys/fs/cgroup.
5. Enter the network namespace with nsenter -n.
6. Enter the mount namespace with nsenter -m.
7. Confirm /proc is mounted from the correct PID namespace.
8. Check UID/GID maps with /proc/<pid>/uid_map and /proc/<pid>/gid_map.
9. Check capabilities with /proc/<pid>/status.
10. Check AppArmor or SELinux labels.
11. Check seccomp mode in /proc/<pid>/status.
12. Reproduce one layer manually with unshare before blaming the runtime.

[IMAGE: Supporting visual 5 for Linux Namespace and cgroup Fundamentals: How Containers Really Work, showing Linux Namespace and cgroup Fundamentals: How Containers Really Work decisions, examples, and Linux, Containers, Namespaces. Alt: Linux Namespace and cgroup Fundamentals: How Containers Really Work linux-namespace-cgroup-fundamentals-how-containers-really-work visual 5]

Useful commands:

sudo lsns -p "$PID"
sudo readlink /proc/"$PID"/ns/*
sudo cat /proc/"$PID"/cgroup
sudo cat /proc/"$PID"/status | grep -E 'Cap|Seccomp|NoNewPrivs'
sudo cat /proc/"$PID"/uid_map
sudo cat /proc/"$PID"/gid_map
sudo nsenter -t "$PID" -a sh

Use nsenter -a carefully. It enters all namespaces it can enter for the target process, which is useful for debugging but not something to run casually on production hosts.

FAQ

What is Linux Namespace and cgroup Fundamentals: How Containers Really Work?

Linux Namespace and cgroup Fundamentals: How Containers Really Work is a practical administration topic that should be evaluated through implementation scope, production risk, testing, documentation, and long-term maintainability.

When should a team use Linux Namespace and cgroup Fundamentals: How Containers Really Work?

Use Linux Namespace and cgroup Fundamentals: How Containers Really Work when it solves a real project constraint, improves clarity, or reduces operational risk. Avoid it when it only adds novelty or hides behavior from future maintainers.

What is the biggest risk with Linux Namespace and cgroup Fundamentals: How Containers Really Work?

The biggest risk is copying a pattern without its context. Production systems need clear boundaries, rollback options, tests, and observability before a technique becomes dependable.

How do you test Linux Namespace and cgroup Fundamentals: How Containers Really Work?

Test the smallest unit that owns the behavior, then add integration coverage for the path users or systems actually rely on. Include failure cases, configuration differences, and regression checks.

How does Linux Namespace and cgroup Fundamentals: How Containers Really Work affect SEO and AI search visibility?

It improves visibility when the article gives a direct answer, expert context, structured headings, internal links, trustworthy references, and FAQ content that matches the visible page.

Conclusion

Linux Namespace and cgroup Fundamentals: How Containers Really Work is worth doing when the implementation improves clarity, reliability, or delivery speed. It is not worth doing when it hides ownership, increases operational risk, or makes the system harder to explain.

Use the framework above as a review checklist. Then connect this topic to the rest of the project documentation so readers can move from concept to implementation without losing context.