`nsenter` enters existing namespaces. By targeting PID 1 (the host's init process) with all namespace flags, the command enters the host's mount, UTS, IPC, network, and PID namespaces—effectively providing a host shell from within the container.