Struct BridgeNetwork 

pub struct BridgeNetwork { /* private fields */ }

Bridge network manager

Implementations

impl BridgeNetwork

pub fn setup(pid: u32, config: &BridgeConfig) -> Result<Self>

Set up bridge networking for a container

Creates bridge, veth pair, assigns IPs, enables NAT. Must be called from the parent process after fork (needs host netns).

State transitions: Unconfigured -> Configuring -> Active

pub fn setup_with_id( pid: u32, config: &BridgeConfig, container_id: &str, ) -> Result<Self>

Set up bridge networking with an explicit container ID for IP tracking.

pub fn apply_egress_policy(&self, pid: u32, policy: &EgressPolicy) -> Result<()>

Apply egress policy rules inside the container’s network namespace.

Uses iptables OUTPUT chain to restrict outbound connections. Must be called after bridge setup while the container netns is reachable.

pub fn cleanup(self) -> Result<()>

Clean up bridge networking

State transition: Active -> Cleaned

pub fn cleanup_orphaned_rules(subnet: &str)

Detect and remove orphaned iptables rules from previous Nucleus runs.

Checks for stale MASQUERADE rules referencing the nucleus subnet that have no corresponding running container. Prevents gradual degradation of network isolation from accumulated orphaned rules.

pub fn write_resolv_conf(root: &Path, dns: &[String]) -> Result<()>

Write resolv.conf inside container (for writable /etc, e.g. agent mode)

pub fn bind_mount_resolv_conf(root: &Path, dns: &[String]) -> Result<()>

Bind-mount a resolv.conf over a read-only /etc (for production rootfs mode).

Creates a memfd-backed resolv.conf and bind-mounts it over /etc/resolv.conf so it works even when the rootfs /etc is read-only. The memfd is cleaned up when the container exits.

Trait Implementations

impl Drop for BridgeNetwork

fn drop(&mut self)

Executes the destructor for this type.