Network Namespace Migration Patterns

In this lesson, you will learn how to transition active network interfaces between namespaces without losing connectivity or triggering stateful packet drops.

The Challenge of Migration

When you move a virtual ethernet (veth) interface from one network namespace to another, the Linux kernel implicitly flushes the interface’s state. If an application has an active TCP connection bound to that interface, simply running ip link set veth1 netns <pid> will cause the connection to hang or reset, as the interface effectively "disappears" and "reappears" with a blank slate.

Achieving Seamless Migration

To migrate an interface while preserving connectivity, you must decouple the interface's lifecycle from the application's socket state. The pattern involves a "pre-flight" preparation phase:

1. Preparation: Before moving the interface, you must ensure the destination namespace is aware of the interface's configuration. You pre-configure the target namespace with the necessary routing table entries and firewall rules (via iptables or nftables) that mirror the source.
2. Atomic Migration: Move the interface using the ip link command.
3. Stateful Re-attachment: Because the interface is down momentarily during the move, you must bring it back up in the destination namespace and immediately re-trigger Gratuitous ARP (GARP) updates. This informs the upstream switch or bridge that the MAC address of the container has moved to a new logical port, preventing traffic blackholing.

# On the host, move the interface
ip link set veth_child netns <target_pid>

# Inside the target namespace, restore connectivity immediately
nsenter -t <target_pid> -n ip link set veth_child up
nsenter -t <target_pid> -n arping -U -I veth_child <interface_ip>

Why this matters

By ensuring the destination namespace has the same conntrack rules and routing tables ready before the move, you minimize the "blackout" window. While the TCP stack will experience a micro-burst of latency, the connection remains valid because the underlying socket in the application memory space remains associated with the interface index (if index preservation is possible) or is re-validated by the network stack once the interface resumes.

Key Takeaway: Network namespace migration requires pre-configuring the target environment and performing an immediate ARP re-broadcast to ensure the network fabric updates its forwarding state before existing connections time out.