Thanks for the description. I guess container networking like Weave works by 'hijacking' veth and executing NAT-like address translation. like a virtual mac

Thanks for the description. I guess container networking like Weave works by 'hijacking' veth and executing NAT-like address translation. like a virtual machine. That's surprising. Containers were advertised to me as being much more lightweight than conventional virtualisation (e.g. VMware, Xen), because the former, unlike the latter, share the ambient operating system. completely separate network stack What does that mean exactly, does the container copy the actual code, or is the network stack's code shared, just run in a separate address space?