Network namespaces give a process its own completely isolated network stack — its own interfaces, routing table, and firewall rules, invisible to the rest of the system. This is the exact mechanism containers use for network isolation.
# Create a new, isolated network namespace sudo ip netns add myns # List namespaces ip netns list # Run a command inside the namespace - it sees NO network interfaces at all initially sudo ip netns exec myns ip addr show # Create a virtual ethernet pair to connect the namespace to the host sudo ip link add veth-host type veth peer name veth-ns sudo ip link set veth-ns netns myns # Configure both ends and bring them up sudo ip addr add 10.0.0.1/24 dev veth-host sudo ip netns exec myns ip addr add 10.0.0.2/24 dev veth-ns sudo ip link set veth-host up sudo ip netns exec myns ip link set veth-ns up
This is literally how Docker gives each container its own IP address and network stack — docker run creates a network namespace under the hood, connects it to a bridge with a veth pair, exactly like the manual steps above, just automated for you.