A method of managing data packet addressing in a virtual machine, wherein the virtual machine comprises a user namespace which provides an application namespace to support applications and/or services and a virtual switch namespace which provides virtual switch operations, wherein the namespaces (120, 121) isolate and virtualize system resources for a collection of processes therewithin; the method comprising, in the virtual switch namespace of the virtual machine: receiving a data packet, sent from the user namespace, at a first interface of the virtual switch namespace, wherein the first interface is paired with a second interface of the user namespace, wherein the pairing results in the applications and services executing within the user namespace communicating as though the second interface is a network interface for the virtual machine; determining whether the data packet includes a destination address for a node in an overlay network for the virtual machine, wherein the overlay network is defined for multiple virtual machines, or a destination address for a service node in an underlay network outside of the overlay network; if the data packet is destined for the service node in the underlay network, modifying addressing in the data packet to support the underlay network, including replacing a first source address in the data packet associated with the overlay network and the user namespace with a second source address associated with the underlay network and a virtual network interface 'VNIC' of the virtual machine, and transferring the data packet over the VNIC of the virtual machine; and if the data packet is intended for the node in the overlay network, encapsulating the data packet using source and destination addresses of the underlay network and forwarding the encapsulated data packet to the node in the overlay network using the VNIC of the virtual machine. wherein the virtual machine comprises a user namespace which provides an application namespace to support applications and/or services and a virtual switch namespace which provides virtual switch operations, wherein the namespaces (120, 121) isolate and virtualize system resources for a collection of processes therewithin; the method comprising, in the virtual switch namespace of the virtual machine: receiving a data packet, sent from the user namespace, at a first interface of the virtual switch namespace, wherein the first interface is paired with a second interface of the user namespace, wherein the pairing results in the applications and services executing within the user namespace communicating as though the second interface is a network interface for the virtual machine; determining whether the data packet includes a destination address for a node in an overlay network for the virtual machine, wherein the overlay network is defined for multiple virtual machines, or a destination address for a service node in an underlay network outside of the overlay network; if the data packet is destined for the service node in the underlay network, modifying addressing in the data packet to support the underlay network, including replacing a first source address in the data packet associated with the overlay network and the user namespace with a second source address associated with the underlay network and a virtual network interface 'VNIC' of the virtual machine, and transferring the data packet over the VNIC of the virtual machine; and if the data packet is intended for the node in the overlay network, encapsulating the data packet using source and destination addresses of the underlay network and forwarding the encapsulated data packet to the node in the overlay network using the VNIC of the virtual machine. receiving a data packet, sent from the user namespace, at a first interface of the virtual switch namespace, wherein the first interface is paired with a second interface of the user namespace, wherein the pairing results in the applications and services executing within the user namespace communicating as though the second interface is a network interface for the virtual machine; determining whether the data packet includes a destination address for a node in an overlay network for the virtual machine, wherein the overlay network is defined for multiple virtual machines, or a destination address for a service node in an underlay network outside of the overlay network; if the data packet is destined for the service node in the underlay network, modifying addressing in the data packet to support the underlay network, including replacing a first source address in the data packet associated with the overlay network and the user namespace with a second source address associated with the underlay network and a virtual network interface 'VNIC' of the virtual machine, and transferring the data packet over the VNIC of the virtual machine; and if the data packet is intended for the node in the overlay network, encapsulating the data packet using source and destination addresses of the underlay network and forwarding the encapsulated data packet to the node in the overlay network using the VNIC of the virtual machine.