Container & Kubernetes Networking
Network namespaces, virtual interfaces, bridges, and just enough Kubernetes to understand pod IPs, services, ingress and network policies.
A Linux network namespace is a private copy of the whole network stack — interfaces, addresses, routes, firewall rules, ports — so two containers can each bind :80 and never meet; a veth pair is the virtual cable that connects a namespace back to the host.
A container’s eth0 is one end of a veth pair on a host bridge; published ports are DNAT rules in the host kernel, container DNS is a tiny resolver the runtime injects, and `localhost` inside the container is the container — not the host.
Kubernetes gives every pod a routable IP with no NAT between pods, turns a Service into a virtual IP that the node kernel rewrites to a live pod, exposes L7 routing as an ingress proxy, resolves names through cluster DNS, and lets a network policy be a namespaced firewall — all implemented by a pluggable CNI.