moby/moby

Network, Sandbox, Endpoint

Definition

The libnetwork CNM trio:

Primitive	What it represents
Network	A logical group of endpoints. Owned by a driver (bridge/overlay/macvlan/...).
Endpoint	The connection between a sandbox and a network. Implementation: a veth pair, an HCS endpoint, or an overlay port.
Sandbox	A container's network namespace + DNS + routing config. Holds 0..N endpoints from 0..N networks.

These are defined in daemon/libnetwork/ (see also the Networking page for the full subsystem deep-dive).

API representation

The wire types are in api/types/network/:

Type	Purpose
`CreateRequest`	`POST /networks/create` body.
`Inspect` (`Network`)	`GET /networks/{id}` response.
`EndpointSettings`	A container's view of its endpoint on a single network.
`IPAMConfig`	Subnet, gateway, IP range, and aux addresses.
`Settings` (in `daemon/network/settings.go`)	Per-container live network state.

Internal objects

Object	File
`Network` (libnetwork-internal)	`daemon/libnetwork/network.go`
`Endpoint`	`daemon/libnetwork/endpoint.go`
`Sandbox`	`daemon/libnetwork/sandbox.go`
Per-OS sandbox	`sandbox_linux.go`, `sandbox_windows.go`

Lifecycle interaction

When a container starts, the daemon:

Calls controller.NewSandbox(containerID, options...) — creates the namespace.
For each requested network: network.CreateEndpoint(name, opts...), then endpoint.Join(sandbox, opts...).
Hands the sandbox's namespace path to containerd so the container's first process is spawned inside it.

On stop:

endpoint.Leave(sandbox).
endpoint.Delete().
sandbox.Delete().

Sandboxes and endpoints are stored in libnetwork's bbolt-backed datastore at <data-root>/network/. On daemon restart, the controller restores them and re-attaches to existing namespaces if the OS still has them.

Embedded DNS

Each sandbox has its own loopback-bound DNS resolver (see resolver.go). It answers names of containers and (in swarm mode) services attached to the same user-defined networks; everything else is forwarded upstream.