In this lesson, you will learn how Linux network namespaces act as a private "bubble" that gives each container its own isolated network stack.
The Problem: Shared Networking
On a standard Linux machine, there is one global network stack. If one process binds to port 80, no other process on that machine can use port 80. If you tried to run two web server containers that both needed port 80, they would collide immediately. Furthermore, every process would be able to see every network interface and packet on the host. This is a security and operational nightmare.
The Solution: Network Namespaces
A network namespace (or netns) is a feature of the Linux kernel that virtualizes the networking stack. When you start a container, the runtime creates a dedicated network namespace for it. Inside this "bubble," the container has its own:
- Network Interfaces: A private set of
eth0,lo(loopback), etc. - IP Addresses: Its own unique IP address.
- Routing Tables: Its own logic for how to send traffic.
- Port Numbers: Its own
0-65535range, allowing multiple containers to listen on port 80 simultaneously without conflict.
Think of it like giving every container its own miniature virtual router and cable connection, completely invisible to the host or other containers unless you explicitly bridge them together.
Seeing it in Action
When you run a command like docker run --rm alpine ip addr, the ip addr command runs inside the container’s private network namespace. If you run that same command directly on your host machine, you will see a completely different set of interfaces. The host cannot see the container's eth0, and the container sees no trace of the host's physical Wi-Fi or Ethernet hardware.
# View the container's private interface
docker run --rm alpine ip addr show eth0
# View the host's interfaces (different results)
ip addr show
By segmenting the network, namespaces ensure that your applications stay isolated, preventing port collisions and restricting the "visibility" of network traffic between different services.
Key Takeaway: Network namespaces provide each container with an independent, isolated network stack, enabling multiple containers to share the same host while using the same ports without interference.