What is a network namespace, and what does it isolate?
Show the answer
Say this first
A network namespace is a separate copy of the kernel network stack: its own interfaces, addresses, routing
tables and rules, neighbour table, netfilter rules, conntrack table, sockets and net.* sysctls. A new
namespace contains only a loopback interface, and it is down. Every container runs in its own network
namespace; ip netns creates and enters named ones for labs and tooling.
Go deeper
Working with them
ip netns add red
ip netns list
ip netns exec red ip -br addr # run any command inside
ip -n red link set lo up # short form of ip netns exec red ip ...
ip link set ens256 netns red # move a physical NIC in
ip netns exec red bash # a shell inside$ ip netns exec red ip -br addr
lo DOWNBring lo up or anything that talks to 127.0.0.1 inside the namespace fails.
Getting traffic in and out
- A veth pair, one end inside and one in the root namespace or on a bridge.
- Moving a physical NIC or SR-IOV virtual function inside.
- macvlan or ipvlan devices on top of a host NIC.
Finding namespaces you did not create
ip netns list only shows names bind-mounted under /run/netns. Docker and Kubernetes namespaces belong to
processes: lsns -t net lists them, and nsenter -t <pid> -n ip addr runs a command inside one.
They will ask next
How does a namespace differ from a VRF?
A VRF (an l3mdev device) separates routing tables only: interfaces stay in one stack and sockets can be bound to the VRF. A namespace separates everything, including firewall rules and sockets. VRFs suit a router with a management VRF; namespaces suit containers and full isolation.
Can two namespaces use the same IP addresses?
Yes. Each has its own interfaces and routing tables, so overlapping addresses never meet. That is why every container can have an
eth0with similar addresses, and why namespaces are handy for testing overlapping customer networks on one box.
Traps
- Forgetting
ip link set lo upin a new namespace. - Expecting
ip netns listto show Docker containers.