From veth Pairs to Services: The Secret Life of Container Packets

Containers make networking look simple: kubectl exec into a pod and curl just works. But under the hood lies a fascinating stack of Linux features — network namespaces, veth pairs, bridges, and iptables — that power connectivity in both standalone Docker containers and Kubernetes pods.

In this talk, we’ll peel back the layers of container networking. Starting from first principles, we’ll use Go code to create a network namespace and connect it with a veth pair. From there, we’ll trace how packets move through bridges, NAT, and CNI plugins, eventually mapping these concepts to Kubernetes Services and cluster-wide networking. Along the way, we’ll demystify common issues: why DNS sometimes fails in pods, how packets traverse nodes, and what happens when you exec into a container and run ping.

Attendees will leave with a clear mental model of container networking, enabling them to debug issues confidently and design Kubernetes applications that behave predictably at scale.