Each Docker container runs in its own network namespace, isolating its network environment.
docker inspect -f '{{ .NetworkSettings.SandboxKey }}' container_name