Network namespace
Linux isolation where a process group gets its own network stack: own interfaces, IP addresses, routing tables, iptables rules. Together with other namespaces, the foundation for containers.
ip netns add foo creates a netns. ip netns exec foo bash runs a shell inside. veth pairs are the common way to connect namespaces: one end in host, the other in ns. Docker uses bridge mode by default — container in its own netns connected to the docker0 bridge. Host mode (--net=host) skips isolation, container shares host stack. Classic debug use: test different network configurations without touching the host. Multiple netns + WireGuard = easy per-process anonymization.