veth + Bridge + NAT

A network namespace alone is just an isolated stack with lo — useless for talking to anything. Docker's default bridge network is built from three primitives:

1. A bridge (docker0, 172.17.0.1/16) on the host — a virtual L2 switch.
2. A veth pair per container — two virtual NICs joined like a cable. One end (vethXYZ) is attached to docker0; the other (eth0 inside the container) lives in the container's netns.
3. NAT rules in iptables/nftables — outbound packets from 172.17.0.0/16 get SNAT'd to the host's IP so they can reach the internet.

              eth0 (host, public IP)
                  |
              [NAT: MASQUERADE]
                  |
              docker0 (172.17.0.1)  <- bridge
              /              \
           veth1             veth2
         (host end)        (host end)
             |                 |
         eth0 in              eth0 in
         ns container_a       ns container_b
         172.17.0.2           172.17.0.3

Why all three pieces are needed

• veth alone: containers can't talk to each other (no shared L2 segment).
• bridge alone: no way to get traffic in or out of a netns.
• NAT alone: nothing to NAT.

Routing decisions inside the container

The container's routing table typically has:

• 172.17.0.0/16 dev eth0 — direct delivery on the bridge
• default via 172.17.0.1 dev eth0 — send everything else to the gateway (the bridge IP), which the host's iptables MASQUERADE rule rewrites to the host's source IP

For this exercise: simulate the routing decision — direct delivery vs NAT'd via gateway.

Reference: man 8 ip-netns, man 8 brctl; Liz Rice ch. 10.