The Container Network Model
In one sentence: All container networking reduces to three nouns — a sandbox (a container's private network stack), a network (an isolated group that can communicate), and an endpoint (the joint plugging one sandbox into one network).
You already know
- From Lesson 4: the NET namespace gives each container empty private interfaces — the sandbox is that namespace plus its config.
- From Lesson 19: the run pipeline calls "allocate network" before writing the bundle.
Three nouns and their arities
The model's power is in its arities. A sandbox belongs to one container. A network contains many endpoints and promises: members can reach each other; non-members cannot. An endpoint joins exactly one sandbox to exactly one network — so a container on two networks has two endpoints, two interfaces, two IPs. This is real segmentation: put web and db on an internal network, web alone also on a frontend network, and the db is unreachable from the edge by construction — no firewall rules to forget.
flowchart LR
subgraph FE["network: frontend"]
EP1["endpoint
eth0 172.18.0.2"]
EP0["endpoint
eth0 172.18.0.3"]
end
subgraph BE["network: internal"]
EP2["endpoint
eth1 172.19.0.2"]
EP3["endpoint
eth0 172.19.0.3"]
end
SW["sandbox: web"] --- EP1
SW --- EP2
SD["sandbox: db"] --- EP3
PROXY["sandbox: edge-proxy"] --- EP0
note1["db has NO endpoint on frontend
→ unreachable from the edge, by construction"]
style note1 fill:#fff8ec,stroke:#f2ddb0
Joining is allocation
sequenceDiagram participant U as User participant E as Engine participant N as Network "internal" participant S as Sandbox (web) U->>E: network connect internal web E->>N: allocate endpoint (IP from this network's subnet) N-->>E: endpoint ready: 172.19.0.2 E->>S: create interface eth1 in the sandbox, assign IP E->>S: add routes for the internal subnet note over S: web now holds two endpoints —
traffic segregates by destination subnet
Anchor these
- Sandbox = per-container stack; network = reachability group; endpoint = the joint (1 sandbox ↔ 1 network).
- Multi-homing is just multiple endpoints; segmentation is just absent endpoints.
- Networks own IP allocation from their subnet.
See what actually stuck.
Take the practice scenarios now.