<p>I have read some tutorials of how to mount a volume in container and run the script on host/node directly. These are the examples given.</p>
<p><strong>DeamonSet pod spec</strong></p>
<pre><code>      hostPID: true
      nodeSelector:
        cloud.google.com/gke-local-ssd: &quot;true&quot;
      volumes:
      - name: setup-script
        configMap:
          name: local-ssds-setup
      - name: host-mount
        hostPath:
          path: /tmp/setup
      initContainers:
      - name: local-ssds-init
        image: marketplace.gcr.io/google/ubuntu1804
        securityContext:
          privileged: true
        volumeMounts:
        - name: setup-script
          mountPath: /tmp
        - name: host-mount
          mountPath: /host
        command:
          - /bin/bash
          - -c
          - |
            set -e
            set -x

            # Copy setup script to the host
            cp /tmp/setup.sh /host

            # Copy wait script to the host 
            cp /tmp/wait.sh /host

            # Wait for updates to complete
            /usr/bin/nsenter -m/proc/1/ns/mnt -- chmod u+x /tmp/setup/wait.sh

            # Give execute priv to script
            /usr/bin/nsenter -m/proc/1/ns/mnt -- chmod u+x /tmp/setup/setup.sh

            # Wait for Node updates to complete
            /usr/bin/nsenter -m/proc/1/ns/mnt /tmp/setup/wait.sh

            # If the /tmp folder is mounted on the host then it can run the script
            /usr/bin/nsenter -m/proc/1/ns/mnt /tmp/setup/setup.sh
      containers:
      - image: &quot;gcr.io/google-containers/pause:2.0&quot;
        name: pause
</code></pre>
<p>(There is a configmap for composing the .sh files. I just skip that)</p>
<p>What does &quot;/usr/bin/nsenter -m/proc/1/ns/mnt&quot; mean? Is this a command to run something on host? what is &quot;/proc/1/ns/mnt&quot; ?</p>

<p>Lets start from the namepaces to understand this in detail :</p>
<p>Namespaces in container helps to isolate resources among the process. Namespaces  controls the resources from the kernal and allocate to the process. This provides a great isolation among different containers that may run in a system.</p>
<p>Having said that, it will also make things complicated with these access restrictions to the namespaces. so comes the nsenter command , which will give the conatiners access to the namespaces. something similar to the sudo command.
.This command can give us access to mount, UTS, IPC, Network, PID,user,cgroup, and time namespaces.</p>
<p>the -m in your example is --mount which will access to the mount namespace specified by that file.</p>
