Network Namespace Migration

In this lesson, you will learn how to physically relocate a network interface from one isolated network namespace to another without dropping your underlying connection state.

The Logic of Namespace Migration

By default, every network interface—whether physical or virtual—exists within a specific namespace, usually the "initial" namespace (init_net). When we create isolated environments for services, we often need to "hand off" an interface from the host to that isolated sandbox.

Think of a network namespace as a private room with its own routing table and firewall rules. Moving an interface is like moving a door from one room to another. Crucially, when you move an interface, it doesn't just change locations; it momentarily disappears from the source namespace and reappears in the target, resetting its state to a "down" status.

Executing the Migration

To move an interface, you must know the process ID (PID) or the name of the target namespace. The utility of choice is ip link.

Suppose you have a virtual ethernet pair (veth0 and veth1) and you want to move veth1 into a namespace named ns_web:

# First, identify the interface in the host
ip link set veth1 netns ns_web

# Once inside the namespace, you must re-initialize it
ip netns exec ns_web ip link set veth1 up
ip netns exec ns_web ip addr add 192.168.1.5/24 dev veth1

Critical Limitations

Migration is powerful, but it comes with strict constraints:

1. State Reset: When you move the device, the interface will automatically transition to the DOWN state, and its IP configuration is often flushed depending on your kernel configuration. You must have a script ready to re-assign addresses immediately upon arrival in the target namespace.
2. Uniqueness: You cannot move an interface that is currently busy or part of a bridge in the source namespace. You must detach it from any bridges (brctl delif) before the migration command will succeed.
3. Namespace Dependency: If the destination namespace is deleted while the interface is inside it, the interface may be destroyed or returned to the root namespace, depending on your kernel version. Always ensure your namespaces have a lifecycle management strategy.

Key Takeaway: Moving an interface between namespaces requires detaching it from local bridges, relocating it via ip link set netns, and re-initializing the link and IP address within the new environment.