Module plugin_loopback_guard 

The plugin loopback-guard verdict sidecar.

The plugin-host daemon loads an nftables rule at startup that keeps a plugin granted network.outbound off the agent’s own loopback listeners, and records whether it loaded here. The plugin lifecycle reads it before it grants network access or renders a unit with it; the status surface reports it. An absent or unreadable sidecar is unavailable: until the daemon has loaded the rule, nothing may assume it is there.

Structs

GuardState

The guard verdict.

Constants

SIDECAR_NAME

The sidecar file name under the run dir.

Functions

read_state

read_state_at against the canonical sidecar.

read_state_at

Read the verdict at path; absent or unparseable reads unavailable.

sidecar_path

The canonical sidecar path (ADOS_RUN_DIR, default /run/ados).