Usually one end stays in the host and the other is moved into a network namespace.