In this lesson, you will learn how to use network namespaces to create a private, isolated networking environment for a specific set of processes.
The Problem: The Shared Networking Stack
By default, all processes on a Linux system share a single global networking stack. If you create a socket and bind it to port 80, any other process on the system is prevented from using that same port. This lack of isolation is a major security and management hurdle when running multiple services, as it forces processes to compete for global resources like the routing table, firewall rules, and interface addresses.
The Solution: Network Namespaces
A network namespace acts as a "virtual sandbox" for networking. When a process is placed into its own network namespace, it gains a completely independent copy of the networking stack. This includes its own set of interfaces, routing tables, and port ranges. From the perspective of a process inside this namespace, the global system’s network interfaces simply do not exist.
A Practical Example
You can observe this isolation using the ip utility. If you create a new namespace named blue, you can launch a process inside it that acts as if it is on a brand-new computer:
# Create a new network namespace
sudo ip netns add blue
# Run a shell inside that namespace
sudo ip netns exec blue bash
# Inside the new shell, check the interfaces:
ip addr
When you run ip addr inside the blue namespace, you will notice that the standard eth0 or wlan0 interfaces are missing. The only thing present is a loopback interface in a DOWN state. Because the process is isolated, you could start a web server on port 80 inside this namespace without causing a conflict with a web server running on your main host system.
By decoupling processes from the global networking state, we gain the ability to create secure, self-contained environments where processes only interact with the network resources we explicitly provision for them.
Key Takeaway: Network namespaces provide total isolation by giving processes their own private copy of the networking stack, allowing them to bind to ports and manage interfaces without affecting—or being affected by—the host’s global network configuration.