Network & Infrastructure / Linux Networking & Host Performance
Network namespaces and a listener invisible to the host shell
An application listens successfully inside its container or namespace, but a host-level port check reports nothing. Investigators may be examining a different network stack from the workload.
Environment and inputs: Linux network namespaces, host routing and network drivers; availability and semantics depend on kernel and driver versions. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Record process namespace membership, interfaces, routes, listeners and any veth or proxy path connecting to the host. Compare the workload's view with the host view explicitly.
Explain the result
Network namespaces isolate networking objects. A socket in one namespace does not automatically appear in another, and publishing it requires an intentional forwarding or proxy design.
Plan the fix
Repair the intended namespace-to-service exposure path and its access policy. Avoid moving the workload into the host namespace merely to make a diagnostic command display the listener.
Check the result and rollback
Validate service access from intended clients and refusal from excluded networks. Restore the former namespace configuration if isolation changes or unrelated host ports become reachable.