networking

type Config struct {
	DataDir   string
	Subnet    string // container subnet (auto-selected if empty)
	MTU       int    // bridge MTU (auto-detected from host if 0)
	CNIBinDir string // path to CNI plugin binaries (Linux only, ignored elsewhere)

	// GatewayPorts are the extra TCP ports on the host/gateway address that a
	// container may reach (e.g. the Go module proxy). On Linux this is a true
	// allow-list: EPHEMERD-INPUT default-denies container→host traffic and
	// admits only DNS plus these ports. Anything listed here is exposed to
	// hostile job code, so list only services meant for jobs. Ports that are
	// also ControlPorts are ignored rather than opened.
	GatewayPorts []int

	// ControlPorts are TCP ports the ephemerd control plane binds on the
	// gateway (bridge) address that MUST NOT be reachable from inside
	// containers: the in-VM containerd (default 10000), the unauthenticated
	// dispatch gRPC server (containerd+1), and the debug exec server
	// (containerd+2). The firewall adds targeted INPUT DROP rules from the
	// container subnet to the gateway on these ports. Empty = no INPUT
	// control-plane rules (e.g. a bare-metal Linux host with no in-VM
	// dispatch server listening on the bridge).
	ControlPorts []int

	// The fields below configure the Windows L2Bridge egress path (see
	// network_windows.go and l2bridge.go). They are ignored on Linux/macOS.
	// When L2BridgeEgress is false (the default), Windows uses the HNS NAT
	// network and none of them are consulted.
	//
	// L2BridgeEgress is the opt-in. HostNIC (the host adapter to bridge onto)
	// and IPPool (the reserved LAN range container addresses come from) are
	// REQUIRED when it is set; Subnet and Gateway are derived from HostNIC when
	// empty. PublicDNS defaults to public resolvers so container DNS never needs
	// the blocked LAN router. ExtraAllowedCIDRs carves destinations out above
	// the RFC1918 block.
	L2BridgeEgress    bool
	HostNIC           string
	IPPool            string
	Gateway           string
	PublicDNS         []string
	ExtraAllowedCIDRs []string

	// AllowHostAccess permits job containers to address the ephemerd host
	// itself on the L2Bridge path. Required by anything ephemerd serves TO
	// containers over the network — the per-job dind Docker API and the Go
	// module proxy both listen on the host address — because the egress ACLs
	// otherwise block the host along with the rest of RFC1918.
	//
	// It is an address-scoped /32 allow, so it opens every port the host has
	// listening, not just ephemerd's. The control-plane ports are blocked back
	// off at the host firewall (see l2BridgeControlPlaneRules), which CAN match
	// on the container source here because L2Bridge does not NAT. Left false
	// when nothing needs to be reachable, which is the strictest posture.
	AllowHostAccess bool

	Log *slog.Logger
}

type Manager struct {
	// contains filtered or unexported fields
}

type SetupResult struct {
	// NetNS is the network namespace identifier (Linux: path, Windows: namespace ID).
	NetNS string
	// EndpointID is the HCN endpoint ID (Windows only). Used to attach
	// the network to the container via the OCI spec.
	EndpointID string
	// IP is the container's IP address on the container network. Populated on
	// Linux from the CNI result, and on Windows from the HCN endpoint — the
	// address ephemerd pinned on the L2Bridge path, the one HNS allocated on
	// the NAT path. Empty on macOS.
	//
	// Not informational: it is the scope of the per-job dind host-firewall
	// allow (see OpenHostPort). An empty IP on a platform that needs one costs
	// the job its Docker access, by design.
	IP string
}