networking

type Config struct {
	DataDir      string
	Subnet       string // container subnet (auto-selected if empty)
	MTU          int    // bridge MTU (auto-detected from host if 0)
	CNIBinDir    string // path to CNI plugin binaries (Linux only, ignored elsewhere)
	GatewayPorts []int  // extra TCP ports to allow from containers to the gateway (e.g., module proxy)

	// ControlPorts are TCP ports the ephemerd control plane binds on the
	// gateway (bridge) address that MUST NOT be reachable from inside
	// containers: the in-VM containerd (default 10000), the unauthenticated
	// dispatch gRPC server (containerd+1), and the debug exec server
	// (containerd+2). The firewall adds targeted INPUT DROP rules from the
	// container subnet to the gateway on these ports. Empty = no INPUT
	// control-plane rules (e.g. a bare-metal Linux host with no in-VM
	// dispatch server listening on the bridge).
	ControlPorts []int

	// The fields below configure the Windows L2Bridge egress path (see
	// network_windows.go and l2bridge.go). They are ignored on Linux/macOS.
	// When L2BridgeEgress is false (the default), Windows uses the HNS NAT
	// network and none of them are consulted.
	//
	// L2BridgeEgress is the opt-in. HostNIC (the host adapter to bridge onto)
	// and IPPool (the reserved LAN range container addresses come from) are
	// REQUIRED when it is set; Subnet and Gateway are derived from HostNIC when
	// empty. PublicDNS defaults to public resolvers so container DNS never needs
	// the blocked LAN router. ExtraAllowedCIDRs carves destinations out above
	// the RFC1918 block.
	L2BridgeEgress    bool
	HostNIC           string
	IPPool            string
	Gateway           string
	PublicDNS         []string
	ExtraAllowedCIDRs []string

	// AllowHostAccess permits job containers to address the ephemerd host
	// itself on the L2Bridge path. Required by anything ephemerd serves TO
	// containers over the network — the per-job dind Docker API and the Go
	// module proxy both listen on the host address — because the egress ACLs
	// otherwise block the host along with the rest of RFC1918.
	//
	// It is an address-scoped /32 allow, so it opens every port the host has
	// listening, not just ephemerd's. The control-plane ports are blocked back
	// off at the host firewall (see l2BridgeControlPlaneRules), which CAN match
	// on the container source here because L2Bridge does not NAT. Left false
	// when nothing needs to be reachable, which is the strictest posture.
	AllowHostAccess bool

	Log *slog.Logger
}

type Manager struct {
	// contains filtered or unexported fields
}

type SetupResult struct {
	// NetNS is the network namespace identifier (Linux: path, Windows: namespace ID).
	NetNS string
	// EndpointID is the HCN endpoint ID (Windows only). Used to attach
	// the network to the container via the OCI spec.
	EndpointID string
	// IP is the container's IP address on the bridge network.
	// Populated on Linux from the CNI result; empty on other platforms.
	IP string
}