Brilliant write up. Lots of this topic is so much easier to understand when it’s presented from first principles, without any of the LXC or Docker helpfulness hiding the details.

(If the author is reading, thank you! I’ll likely use this material for the pupils in my computer club.)

Managing an IPv6 stack alongside IPv4 is also very informative. IPv6 is still not widely deployed — SMTP is likely tied to v4 for all eternity — but it’s incredibly useful for managing multiple sites of inventory over the internet. Seeing RFC1918 style 10.x.y.z private addresses and IPAM in use by internal ops and IT in 2021 brings tears to my eyes.

Adding a section on using conntrack to watch the way in which the kernel handles MASQUERADE and DNAT would be illustrative as well.

I really like the diagrams too.