Workload Networking Model

A host port is an exclusive claim on a host address, so only one mapping can hold it there. Inside, each container has its own network view, so both processes can hold 8080 without ever meeting.

Publishing claims a port on the host and installs an address-translation rule, so traffic arriving at that host port is rewritten and delivered to the container's own address and port. The process inside binds nothing on the host and is unchanged.

Four entry shapes: internal-only, a port reserved on every host, a balancer provisioned for that one workload, or a shared edge routing many hostnames and paths. They trade cost per external address against routing power and blast radius.

The bind address decides which interfaces a listener will accept traffic on. Bound to loopback, it accepts only what arrives on that view's loopback; traffic from outside arrives on the container's other interface and is never delivered to it.

A compromised workload can reach every other workload on the cluster network, in any grouping, on any port they are listening on. Most container platforms ship an allow-everything default, so reachability stays universal until a rule narrows it.

Wrapping costs bytes and work: an outer host-to-host header rides on every packet and leaves fewer usable bytes inside it, both hosts spend processor time adding and stripping it, and the network between them sees only host addresses.

Giving each workload its own fleet-routable address lets any workload dial any other directly, with no port bookkeeping and no rewritten source address, so callers reach a workload rather than the host it happens to sit on.

It resolves to a virtual address allocated to the service declaration itself, not to any replica. Replica churn changes only the member set behind that address, so the name and address a caller holds stay valid for as long as the service exists.

Each workload's own balancer holds an allocated external address and a managed balancer instance, both charged for as long as they exist, with traffic on top — forty times over. A shared edge routing by hostname and path collapses forty addresses into one.

Name resolution stops working first. The resolver is itself reached over the network, so unless the outbound allowlist permits it, every lookup fails and each dependency appears to be down rather than blocked.

It buys external reachability with nothing allocated and no per-workload bill. It costs a fleet-scarce, exclusive port number, a client that must be handed host addresses which change on every resize, and every host listening on that number.

A port number is scoped to a network view, not to the machine. Each container normally has its own view and therefore its own port space, so port 8080 in one is a different port from 8080 in the other.

Select by label, not by address. A workload's address is a short-lived lease from a per-host pool: a rescheduled replica returns with a different one, so an address-pinned rule silently stops matching, or later matches whoever inherits that address.

Running on the host's own network view removes the mapping entirely: the process binds host ports directly, sees client addresses unrewritten, and pays no translation cost — at the price of host-wide port collisions and a lost network boundary.

Its address is removed from the member set, so no new connections are dispatched to it, while the process itself keeps running untouched. When it reports ready again the address is added back silently, with no caller involvement and no event a caller sees.

One party then holds and renews certificates covering every hostname the edge answers for, instead of forty teams each remembering their own. That concentrates the expiry risk into one estate-wide incident and concentrates the ability to fix it in one place.

They must be placed in one shared network view, not merely on the same host. Sharing the view gives them one interface, one address, one loopback and one port space, so the helper's call to loopback reaches the worker instead of itself.

Almost certainly a packet-size mismatch. The workload interface still advertises the link's full size, so once the host adds its wrapper the frame exceeds what the link carries and is dropped. Small exchanges never fill a packet, so they survive.

Addresses are a capacity dimension of their own. One pool is carved into fixed per-host ranges, so a host whose range is used up places nothing more, whatever its spare processor. The fix is re-planning the ranges or enlarging the pool.

The publishing hop rewrites the destination so packets reach the container and, in most implementations, rewrites the source too so replies return through the host to be un-translated. The application therefore sees one internal address for every client.

Because a member is chosen when a connection is established, not when a request is sent. A pool holds its connections for hours, so the choice made at open time is never revisited, and the abstraction only helps callers that open new connections.

Set a default most workloads never have to argue with — internal-only inside, one shared edge outside — then write the exemption test: traffic the edge cannot route, a blast radius that cannot be shared, volume that would distort the edge. Then fund the edge's owner.

Derive the real dependency graph from observed traffic, restrict inbound before outbound, stage it workload by workload starting with the highest-value receivers, and let each team own its own rule. Label hygiene and enforcement coverage are the prerequisites.

Decide on control of the network, the address budget and what you need to see - not on benchmarks. An overlay needs no cooperation and lets pools repeat per cluster; native routing costs real addresses and agreement, and returns headroom and workload-level visibility.

Not the platform itself. It defines a small contract and calls a pluggable attachment driver before the workload's first process starts, handing it the workload's private network view; the driver builds the interface, takes an address from the host's range and returns it.

An enforcing component on the host where the workload runs. A stored rule is only a declaration; something local to each host must translate it into packet filtering; if nothing does, the rule is stored without error and enforces nothing.

Grant it only where the caller genuinely must reach a particular member rather than any member: replicas forming a group among themselves, a caller that must reach the instance holding a given piece of state, or per-instance collection. Everything else keeps the virtual address.