A PID identifies a process within a system. Linux can create a PID namespace so that a process and its descendants have an isolated view of process identifiers.
A child process with its own view
When a process is created with fork, the child receives a different identifier in the same process space. With clone and the CLONE_NEWPID flag, the child instead starts a separate PID hierarchy.
From inside that namespace, the first process appears as PID 1. Outside it, the host still assigns the process its normal PID. The same process can therefore have different identifiers depending on which namespace observes it.
What isolation means
The kernel contextualises process operations according to the namespace from which they are performed. This makes isolated process trees possible and is one of the building blocks used by containers.
PID isolation alone does not make a secure container; it is combined with other namespaces, resource controls and security policies.
Next in the series
In part two, we look at the UTS namespace and how it gives a group of processes its own hostname.