In this lesson, you will learn how to create independent network stacks within a single Linux kernel to achieve container-like isolation.
The Concept of Network Namespaces
At its core, a network namespace is a logical copy of the entire networking stack. When you create one, the kernel provides that namespace with its own private set of routing tables, firewall rules, and network interfaces. To processes running inside this namespace, it appears as though they are on a completely independent machine, even though they share the same underlying hardware and kernel.
This isolation is the foundation of container technology. Without namespaces, every process would see the host’s physical ethernet ports, VPN tunnels, and local loopback addresses, making it impossible to run multiple applications with conflicting network requirements (like two web servers both needing to bind to port 80).
Deploying Isolated Stacks
To demonstrate, you can use the ip netns command. This tool manages the kernel's ability to compartmentalize network resources.
First, create a new isolated network environment:
sudo ip netns add my_container_net
Once created, this namespace has a completely empty network stack. You can verify this by comparing the loopback status of the host versus the namespace:
# Check host loopback
ip link show lo
# Run a command inside the isolated namespace
sudo ip netns exec my_container_net ip link show lo
In the host namespace, the loopback device is UP. In the my_container_net namespace, it is DOWN. Because the kernel treats these as distinct stacks, you must bring the interface up inside that specific namespace to activate it:
sudo ip netns exec my_container_net ip link set lo up
By segmenting the kernel's view of the network stack, you ensure that processes inside my_container_net cannot interfere with—or even "see"—the configuration of the host or other namespaces. This architectural boundary prevents network-level data leakage and allows for fine-grained control over how specific workloads communicate with the outside world.
Key Takeaway: Network namespaces allow you to virtualize the Linux network stack, providing each workload with its own private routing table and interface set, effectively creating a sandbox for network operations.