You're wrong and right, because "container" is ill-defined. If you run your container in the host network namespace, then there's zero overhead. It's more common to have your container's "nic" be one end of a veth pair. That's not free.

Finally many platforms like docker, in the past, will spin up userspace proxies (docker-proxy) which is even more expensive.