Namespaces in operation, part 4: more on PID namespaces

A fresh network namespace only has a loopback interface. If you don't add any other interfaces, it's totally isolated network-wise.

(Note that you can still connect to filesystem-namespace unix sockets if you can access them as files -- you need to chroot or use mount namespaces if you want to hide them as well. I believe abstract namespace unix sockets are isolated per-namespace.)