In this lesson, you will learn how to provide containers with their own private network stacks so they can communicate independently without interfering with the host machine.
The Problem: Shared Networks
On a standard Linux machine, all processes share a single network stack. They all see the same network interfaces (like eth0), the same routing table, and the same IP address. If two applications on your host need to bind to the same port (like port 80 for a web server), they will collide, and one will fail. This is a nightmare for portability and resource isolation.
The Solution: Network Namespaces
A Network Namespace acts like a private "virtual playground" for networking. When we place a process inside a network namespace, it stops seeing the host's network and instead sees its own set of virtual interfaces, IP addresses, and routing rules.
To the process inside the namespace, it looks like it has a dedicated computer with its own network card. To the host, however, it is just a set of isolated instructions.
Visualizing the Setup
Imagine you have a host with one network interface. By using namespaces, we can give a container its own lo (loopback) interface and a private eth0 that is logically separated from the host:
# Create a new namespace called "container-net"
ip netns add container-net
# Verify the new namespace exists
ip netns list
Once the namespace exists, you can move a virtual interface into it. Now, any traffic initiated by the process inside container-net remains isolated. Even if that container crashes or changes its IP configuration, the host's networking remains completely unaffected.
This is the foundational magic that allows Docker containers to run on the same machine without worrying about port conflicts or IP address overlap—each container believes it is the sole owner of its network environment. By managing these namespaces, we create the "containers" that make modern deployments like Kubernetes possible.
Key Takeaway: Network namespaces provide isolated virtual network stacks, allowing multiple containers to run on the same host while maintaining their own unique IP addresses, ports, and routing tables.