netrules

func (*Manager) BlockAllEgress ¶

func (m *Manager) BlockAllEgress(containerIP string) error

BlockAllEgress installs a DROP rule for traffic originating from containerIP. The rule lives in DOCKER-USER, the chain Docker explicitly reserves for operator-defined firewall rules. DOCKER-USER is jumped from FORWARD *before* DOCKER-FORWARD, so our DROP fires before Docker's blanket "iifname docker0 accept" rule that would otherwise short-circuit any rule appended directly to FORWARD. This works on iptables-legacy and on Docker 28+/iptables-nft (which writes through to nftables) alike.

func (*Manager) BlockAllIngress ¶ added in v0.1.7

func (m *Manager) BlockAllIngress(containerIP string) error

BlockAllIngress installs a DROP rule for traffic destined for containerIP, the mirror of BlockAllEgress on the destination axis. Used by the network quota enforcer when net_bytes_in_limit is crossed. The honest caveat (also documented in plans/network-usage-tracking.md): host-side ingress is counted after the NIC has accepted the packet, so the meter is "what the container would have seen" rather than "bytes spent on the wire." Same chain (DOCKER-USER) and idempotency check pattern as the egress mirror.

func (*Manager) ClearBlockAllEgress ¶

func (m *Manager) ClearBlockAllEgress(containerIP string) error

func (*Manager) ClearBlockAllIngress ¶ added in v0.1.7

func (m *Manager) ClearBlockAllIngress(containerIP string) error

func (*Manager) Enabled ¶

func (m *Manager) Enabled() bool