Expect(err).NotTo(HaveOccurred())

			nsPath := filepath.Join(tempDir, "namespace")
			nsFile, err := os.Create(nsPath)
			Expect(err).NotTo(HaveOccurred())
			nsFile.Close()

			ns = namespace.NewNamespace(nsPath)
		})

		AfterEach(func() {
			os.RemoveAll(tempDir)
		})

		It("returns an open file representing the namesapce", func() {
			f, err := ns.Open()
			Expect(err).NotTo(HaveOccurred())
			Expect(f.Name()).To(Equal(ns.Path()))
			f.Close()
		})

		Context("when open fails", func() {
			BeforeEach(func() {
				err := os.Remove(ns.Path())
				Expect(err).NotTo(HaveOccurred())
			})

			It("returns the error from open", func() {
				_, err := ns.Open()
				Expect(err).To(HaveOccurred())
			})
		It("should release the IPAM managed address", func() {
			execCNI("DEL", netConfig, containerNS, containerID, sandboxRepoDir)
			Eventually(session, DEFAULT_TIMEOUT).Should(gexec.Exit(0))

			addressPath := filepath.Join("/var/lib/cni/networks", "test-network", containerAddress)
			_, err := os.Open(addressPath)
			Expect(err).To(HaveOccurred())
			Expect(os.IsNotExist(err)).To(BeTrue())
		})

		Context("when the last container leaves the network", func() {
			It("should remove the sandboxNS", func() {
				execCNI("DEL", netConfig, containerNS, containerID, sandboxRepoDir)
				Eventually(session, DEFAULT_TIMEOUT).Should(gexec.Exit(0))

				_, err := sandboxNS.Open()
				Expect(err).To(HaveOccurred())
				Expect(os.IsNotExist(err)).To(BeTrue())
			})
		})

		Context("when a container remains attached to the sandbox", func() {
			var containerNS2 namespace.Namespace

			BeforeEach(func() {
				var err error
				containerNS2, err = namespaceRepo.Create("container-ns-2")
				Expect(err).NotTo(HaveOccurred())

				execCNI("ADD", netConfig, containerNS2, "guid-2", sandboxRepoDir)
				Eventually(session, DEFAULT_TIMEOUT).Should(gexec.Exit(0))