What is a Veth Pair

A veth (virtual ethernet) pair is two virtual network interfaces connected back-to-back like a cable. Whatever enters one end exits the other. Container runtimes use veth pairs to connect a container's isolated network namespace to the host's bridge network.

How it works

When a container starts, the runtime creates a veth pair. One end is moved into the container's network namespace and named eth0 — it becomes the container's primary network interface. The other end stays in the host namespace and is attached to the docker0 bridge.

From the container's perspective, eth0 is a regular network interface with an IP address. The container sends packets through eth0, they traverse the veth pair, arrive at the bridge, and the bridge forwards them to their destination — another container's veth pair, or the host's routing table for external traffic.

On the host, each container's veth end appears as a vethXXXXXX interface attached to the bridge:

$ bridge link show
12: veth7a3d4f@if11: <BROADCAST,UP> master docker0
14: vethb81e23@if13: <BROADCAST,UP> master docker0

When the container is destroyed, both ends of the veth pair are deleted automatically.

Why it matters

Veth pairs are the physical plumbing of container networking. They connect the isolated network namespace to the shared bridge. Understanding veth pairs explains why each container has its own IP, how container-to-container traffic flows through the bridge, and what the vethXXXXXX interfaces on the host actually are.

See How Container Networking Works for the full networking architecture.