In this lesson, you will learn how "veth" pairs act as a virtual bridge to connect your container’s isolated world to the host’s network.
The Virtual Pipe
When you start a container, it exists in its own isolated Linux network namespace (which we covered in lesson 25). Inside that namespace, the container feels like it has its own private network card. However, that card is invisible to your host machine. To allow traffic to flow in and out, the kernel creates a Virtual Ethernet Pair, or veth pair.
Think of a veth pair like a flexible, two-ended virtual cable. One end of this cable is plugged into the container’s network namespace (often appearing as eth0 inside the container), and the other end is plugged into a bridge interface on your host machine (like docker0).
Visualizing the Connection
Because the two ends are linked, anything sent into the container's eth0 is immediately received by the host's bridge interface, and vice-versa. You can see these pairs on your host system using the ip link command:
# List interfaces to see the veth pairs
ip link show
You will notice pairs of interfaces with matching index numbers. For example, if you see a interface named veth1234 on your host, it is the "outer" end of the pipe, while the "inner" end resides inside the container.
Why This Matters
Without veth pairs, your container would be a "black box" with no way to communicate with the outside world. By using these pairs, the host’s bridge acts as a switch, allowing multiple containers to talk to each other and the internet by routing traffic through these virtual cables. It is a elegant way to maintain total isolation for the process while providing the necessary connectivity for modern applications.
Key Takeaway: A veth pair is a virtual patch cable that connects the isolated network namespace of a container to the host’s network bridge, enabling communication while maintaining strict isolation.