Container Basics On Linux (Namespaces/Cgroups)

Isolated network testing in a blink

🧩 The Challenge

You’re debugging some gnarly network problem with a service, and you just need to test a new firewall rule or a different routing table. But you can’t touch your main system’s network config, because that’ll kill your SSH session, or worse, break prod. Nobody wants to spin up a whole VM just for a quick network hack.

💡 The Fix

Forget the VM. You can spin up completely isolated network environments right on your Linux host using network namespaces. Test that crazy routing rule, verify your DNS resolver, or try out new iptables chains without ever touching your real network interfaces.

ip netns add tempnet
ip link add veth_host type veth peer name veth_temp
ip link set veth_temp netns tempnet
ip netns exec tempnet ip link set lo up
ip netns exec tempnet ip addr add 192.168.42.1/24 dev veth_temp
ip netns exec tempnet ip link set veth_temp up
ip addr add 192.168.42.2/24 dev veth_host
ip link set veth_host up
ip netns exec tempnet ping -c 3 192.168.42.2
# To clean up:
ip netns del tempnet

⚙️ Why It Works

This little setup creates a brand new, empty network stack for tempnet, then uses a virtual ethernet pair (veth) to bridge it to your host. One end lives in the host, the other in the new namespace, giving you a private pipe to test through. It’s the same low-level tech containers use to get their own networks.

🚀 Pro-Tip: Use `ip netns exec tempnet bash` to drop into a shell right inside your isolated network.

Linux Tips & Tricks | © ngelinux.com | 10/1/2026