Linux Namespaces are operating system constructs which provides a containers the required isolation so that resources of one container shall not interfere with others containers and the host. In other words, we make sure that a process running in one container can’t easily interfere with the operation of another container or the underlying host?
Linux support following namespaces:
Command to list namespaces:
Network Namespace, the building block of Container Networking.
Network namespace is the core technology that fuels the container networking.Linux contains various features to provide multi-tenant support on host. Various namespace provided different kind of isolation(can be sen from above diagram) where network namespace provides networking resource isolation exclusively.
Network namespace provide isolation of the following networking resource in the system:
Lets demo the network namespace concepts.
- Create two network namespace namely Producer and Consumer using linux ip command
master$ip netns add producer
master$ip netns add consumer
master$ip netns list
producer
Consumer
- Create a virtual enternet cable(veth) with connectors at both end, we will be using the virtual ethernet to connect the network namespace
master$ip link add veth-producer type veth peer name veth-consumer
master$ip link list | grep veth
20: veth-consumer@veth-producer: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
21: veth-producer@veth-consumer: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
- The veth exists on host, lets assign the veth to the created namespaces.
master$ip link set veth-producer netns producer
master$ip link set veth-consumer netns consumer
master$ip link list | grep veth // Wont give any ouput as the veth has moved to namespace on which it get assigned
Lets check the producer and consumer namespace
- Assign the IP’s and make the interfaces up
- Using ping command , validate the network namespaces are connected and reachable.
We have reached the end of this article where we have understood the significance of namespaces. Also we have done hands-on using network namespace, we have created namespace, virtual ethernet, assigned them to created namespaces , assigned ip address and then validated the connectivity between two namespaces.
Now, there is a serious scalability issue with this approach. As the no of namespaces increases we will face tremendous challenge in creating veth pair and connecting the namespace.
Rescue is done by Linux bridge which can tap these network namespaces to the bridge to get connectivity. The same concept applied to the Docker where it sets up networking between containers running on the same host.
We will go over the linux bridge concept and demo in the next chapter.
Good Bye for now.
References:
https://man7.org/linux/man-pages/man7/network_namespaces.7.html