Containers and cloud networking
Network namespace
A separate copy of the kernel's network: its own cards, addresses, routes and firewall, which is what a container's network is.
Linux can give a group of programs a network of their own: a network namespace starts with only lo, and
has its own cards, addresses, route table, ARP cache and iptables rules. A container is programs in namespaces (network,
process, mount and more); Docker makes one network namespace per container. ip netns add web makes a named one,
ip netns exec web <command> runs a command inside it, and ip -n web addr reads it from outside.