Netns

2024-07-21T19:32:02Z

Amelentyev: Fix a syntax error in the config example

{{DISPLAYTITLE:netns}}

'''netns''' (network namespaces) are another instance of the network stack with its own network devices (links), ip setup and firewall rules. Besides of using netns for building containers they can be used to get a stricter isolation than using [[VRF]]s.

== Prerequisites ==

The packages and patches described in this article are available in Alpine edge and ≥3.19.

== netns management ==

=== iproute2 ===

Netns can be ad-hoc managed using the <code>ip netns</code> commands.

{{cmd|<nowiki># ip netns
# ip netns add tenant1
# ip netns del tenant1
# ip netns exec tenant1 ip -br link
</nowiki>}}

=== ifstate ===

[https://ifstate.net IfState], a declarative network configuration tool, is full netns aware since IfState 1.9.0. The following config example creates a wireguard tunnel and a vlan sub-interface. The wireguard link <code>wg0</code> and the vlan sub-interface are moved into the <code>vpn</code> netns.

{{cat|/etc/ifstate/config.yml|<nowiki># root netns
interfaces:
- name: eth0
addresses:
- 198.51.100.2/31
link:
state: up
kind: physical
routing:
routes:
- to: 0.0.0.0/0
via: 198.51.100.1
rules: []

namespaces:
# "vpn" netns
vpn:
interfaces:
- name: eth0.42
addresses:
- 192.0.2.1/25
link:
state: up
kind: vlan
vlan_id: 42
link: eth0
# link to eth0 in root netns
link_netns: null
- name: wg0
addresses:
- 192.0.2.254/30
link:
state: up
kind: wireguard
# bind wireguard to the root netns
bind_netns: null
wireguard:
private_key: !include /etc/wireguard/secret.key
peers:
- public_key: 3Eimby+9YtJwtx+peCsz6RiubRqAp+cATHNiGWsUsEU=
endpoint: 203.0.113.42
persistent_keepalive_interval: 30
allowedips:
- 0.0.0.0/0
routing:
routes:
- to: 0.0.0.0/0
dev: wg0
rules: []
</nowiki>}}

== netns-based Service Isolation ==

Services can be run isolated in a netns ('''and''' [[VRF]] inside the netns) when running at least OpenRC 0.49.0-r1. You can set the <code>$netns</code> variable for the service in {{path|/etc/conf.d}} in most cases.

''The netns must already be created before a service can be started inside of it!''

== netns-compatible initd scripts ==

Not all initd scripts might be netns compatible. Some network stack related packages have been patched to be netns aware:

* ipset
* iptables
* nftables

[[Category:Networking]]

Alpine Linux - User contributions [en]

Netns