Container 06: A Network Namespace and a Virtual Cable

The holes punched in a sealed box. A container’s network is the one hole that is a cable, and this stage lays it.

Before you start. Container 05: Cgroups, Memory and Process Limits finished the box’s ceilings. This stage gives it a network of its own. A network device is something a machine sends packets out of: a network card, or something that pretends to be one. An IP address names a device on a network, and a subnet like 10.200.0.0/24 is a group of addresses that can talk to each other directly (Inside your building (your router's life) draws it; How a parcel finds any house on earth covers what happens when the destination is outside the subnet). A route is a rule saying where to send packets for a given destination. You need those three words and nothing more.

The idea in 30 seconds

A new network namespace is empty: a loopback device that is down and nothing else; without the flag, the box shares the host’s devices and ports.
A veth pair is a virtual cable: a packet sent into one end comes out of the other, and the ends can be in different namespaces.
The host creates the pair, moves one end into the box by pid, and addresses the other; the box brings up lo, renames its end to eth0, addresses it and adds a default route.
A pipe the host closes when ready is a clean way for the child to wait for the cable.
A ping across the cable took about 0.07 ms; a ping to the internet got nothing, because there is no bridge or address translation.
Deleting a namespace destroys the veth ends inside it, and deleting either end deletes both.

Read the story · Skip to the numbers