netrules

func (*Manager) ApplyEgressPolicy ¶ added in v0.5.4

func (m *Manager) ApplyEgressPolicy(containerIP string, allowCIDRs, denyCIDRs []string) error

ApplyEgressPolicy installs a per-container selective egress policy in DOCKER-USER, scoped by source IP and comment-tagged (see egressPolicyComment). Exactly one mode is expected (callers validate mutual exclusivity):

• allowCIDRs non-empty → allowlist: ACCEPT each CIDR, DROP everything else.
• denyCIDRs non-empty → blocklist: DROP each CIDR, leave the rest to Docker's default ACCEPT.

Re-apply is idempotent: every rule is Exists-checked before Insert, so the start/reconcile reapply paths can call this repeatedly without duplicating.

func (*Manager) BlockAllEgress ¶

func (m *Manager) BlockAllEgress(containerIP string) error

BlockAllEgress installs a DROP rule for traffic originating from containerIP. The rule lives in DOCKER-USER, the chain Docker explicitly reserves for operator-defined firewall rules. DOCKER-USER is jumped from FORWARD *before* DOCKER-FORWARD, so our DROP fires before Docker's blanket "iifname docker0 accept" rule that would otherwise short-circuit any rule appended directly to FORWARD. This works on iptables-legacy and on Docker 28+/iptables-nft (which writes through to nftables) alike.

func (*Manager) BlockAllIngress ¶ added in v0.1.7

func (m *Manager) BlockAllIngress(containerIP string) error

BlockAllIngress installs a DROP rule for traffic destined for containerIP, the mirror of BlockAllEgress on the destination axis. Used by the network quota enforcer when net_bytes_in_limit is crossed. The honest caveat (also documented in plans/network-usage-tracking.md): host-side ingress is counted after the NIC has accepted the packet, so the meter is "what the container would have seen" rather than "bytes spent on the wire." Same chain (DOCKER-USER) and idempotency check pattern as the egress mirror.

func (*Manager) ClearBlockAllEgress ¶

func (m *Manager) ClearBlockAllEgress(containerIP string) error

func (*Manager) ClearBlockAllIngress ¶ added in v0.1.7

func (m *Manager) ClearBlockAllIngress(containerIP string) error

func (*Manager) ClearEgressPolicy ¶ added in v0.5.4

func (m *Manager) ClearEgressPolicy(containerIP string, allowCIDRs, denyCIDRs []string) error

ClearEgressPolicy removes the rules ApplyEgressPolicy would have installed for the same (containerIP, allowCIDRs, denyCIDRs). The caller passes the policy persisted on the sandbox row so cleanup is exact and comment-scoped — the blanket BlockAllEgress DROP (no comment) is left untouched.

func (*Manager) Enabled ¶

func (m *Manager) Enabled() bool