A network namespace gives a process a limited view of networking resources. It determines which network interfaces the process can see and isolates network devices, protocol stacks, and ports from those in other network namespaces. It is one of several Linux namespaces that make processes in containers appear to have their own environment. section 2.3.1
Each network interface belongs to exactly one network namespace, though it can be moved to another. Processes can share a namespace instead of each having a separate one. When two processes share a network namespace, they see the same interfaces and use the same IP address and port space. section 2.3.1 section 3.3.1
Kubernetes uses this sharing to bring containers together in a pod. All containers in a pod share its network namespace, interfaces, IP addresses, and port space. They therefore cannot bind to the same port number. Containers in different pods have separate port spaces, so using the same port number in different pods does not create that conflict. section 5.1.1
Two containers, one pod
Imagine an application process and a supporting process running in separate containers in one pod. They share network interfaces and a port space because they share a network namespace, but each container retains its own mount namespace and filesystem view. Sharing networking does not mean sharing every resource. section 3.3.1 section 5.1.1
Figure 5.3 Containers in a pod share the same network interfaces.
The figure shows why containers grouped in one pod see the same network interfaces. section 5.1.1
