Lion Cipher Lab
Build an isolated network by hand with Linux network namespaces and veth
- Foundations
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Every time you run a container you are using this exact machinery, but a runtime hides it so completely that it feels like magic — until the day a container can't reach the internet, or two containers can't see each other, and you have no idea where to look. This lab builds a container's network from scratch with nothing but `ip` and `iptables`: a private isolated network stack (a namespace), a virtual cable into it (a veth pair), an IP address, and a NAT rule for internet access. That is precisely what Docker's docker0 bridge, per-container veth pairs and iptables masquerade rules do for you…
What you'll learn
- creating and inspecting Linux network namespaces (ip netns)
- building and wiring a veth (virtual Ethernet) pair
- assigning IPs, routes and default gateways by hand
- enabling IP forwarding and writing an iptables NAT masquerade rule
- per-namespace DNS with /etc/netns
- reading how Docker/Kubernetes container networking actually works
Steps in this lab
- What a namespace actually is — the primitive under every container
- Confirm you're on a real kernel (Linux, a VM, or WSL2)
- Create the namespace and prove it is isolated
- Build a veth pair — a virtual cable — and plug one end into the namespace
- Give each end an IP, bring them up, and ping across the cable
- Give the namespace internet access: default route, IP forwarding, and a NAT masquerade rule
- This is exactly what Docker does — and when you'd reach for the raw primitives
- Optional stretch: two namespaces on one bridge (the 'many containers' model)
- Clean up — leave the host exactly as you found it