feat(net): per-VM egress networking (netns + TAP + nftables NAT)#64

Open

markovejnovic wants to merge 42 commits into

mainfrom

feat/network-access

Commits on Jul 8, 2026

feat(net): [network] config table (uplink, clone_pool) on both sides
markovejnovic
committed
test(net): prove clone_pool default sync + uplink refusal/fallback contracts
markovejnovic
committed
feat(suidhelper): pure per-VM network address math with refusal contracts
markovejnovic
committed
test(suidhelper): prove per-VM address injectivity + checked final address arithmetic
markovejnovic
committed
feat(suidhelper): network tool argv builders (prepare/teardown/host-init)
markovejnovic
committed
fix(suidhelper): drop metadata IP before egress accept + golden argv sequence tests
markovejnovic
committed
feat(suidhelper): execute network prepare/teardown/host-init via ip+nft
markovejnovic
committed
fix(suidhelper): host-init reconciles to desired state + test networking-disabled refusal
markovejnovic
committed
feat(net): Hyper.SuidHelper.Network wrapper for the network helper op
markovejnovic
committed
feat(net): inner-world MAC + ip= cmdline + NIC spec
markovejnovic
committed
feat(net): populate NIC + ip= cmdline in BootSpec when networking enabled
markovejnovic
committed
feat(suidhelper): jailer --netns derived from vm id when networking enabled
markovejnovic
committed
feat(suidhelper): mknod /dev/net/tun into the jail when networking enabled
markovejnovic
committed
feat(net): prepare netns before jailer launch, tear down on jail clear
markovejnovic
committed
feat(net): host-init nft table at node start + uplink/ip_forward preflight
markovejnovic
committed
feat(net): reaper sweeps orphan VM netns (backstops crashed-node leaks)
markovejnovic
committed
feat(net): guest DNS via hyper.resolver= cmdline written by PID-1 agent
markovejnovic
committed
test(net): pin guest resolver parser rejects look-alike cmdline tokens
markovejnovic
committed
docs: host bootstrap for VM egress networking (ip_forward, nft, [network])
markovejnovic
committed
test(net): live E2E — networked guest reaches the internet
markovejnovic
committed
fix(net): drop guest→host traffic (INPUT isolation) + partial [network] table disables not bricks
markovejnovic
committed
Merge remote-tracking branch 'origin/main' into feat/network-access
markovejnovic
committed
refactor(suidhelper): inline trivial tool-path defaults into Tools::default
markovejnovic
committed
test(net): assert explicit HTTP 200 from guest egress fetch
markovejnovic
committed
feat(net): make VM networking mandatory, not opt-in
markovejnovic
committed
fix(net): drop duplicate run() helpers left by the origin/main merge
markovejnovic
committed
ci(net): modprobe nf_tables + nf_nat on the KVM runner
markovejnovic
committed
fix(net): force tun node to 0666 (mknod umask masked it to 0644)
markovejnovic
committed
fix(net): run ip/nft as genuine root so they don't trip AT_SECURE
markovejnovic
committed
fix(net): default ip path to /usr/bin/ip (not the symlinked /usr/sbin/ip)
markovejnovic
committed
fix(net): run in-netns nft by absolute path under ip netns exec
markovejnovic
committed
fix(net): make network teardown idempotent (tolerate missing netns/veth)
markovejnovic
committed
fix(net): make jail tun-node creation idempotent (tolerate EEXIST)
markovejnovic
committed
fix(net): emit a full six-octet guest MAC
markovejnovic
committed
fix(img): make build_chain total for an unknown (empty-chain) image
markovejnovic
committed
test(e2e): exec guest net checks via absolute /bin/sh
markovejnovic
committed
fix(net): enable ip_forward inside each VM's netns
markovejnovic
committed
test(e2e): temporary guest network diagnostics on egress failure
markovejnovic
committed
test(e2e): log guest net diagnostics via Logger
markovejnovic
committed
test(e2e): single long-deadline egress exec with full diagnostics
markovejnovic
committed
ci(integration): admit guest egress through Docker's FORWARD drop
markovejnovic
committed
test(e2e): clean up network egress test; docs: FORWARD firewall note
markovejnovic
committed