fix: Remove dependency on ip command for container support

[ammar-agent]

Fixes#74

Problem

httpjail failed when running inside Docker containers or minimal environments that don't include the iproute2 package (which provides the ip command). This affected users running httpjail in:

• Minimal container images (Alpine, distroless, etc.)
• Container runtimes like sysbox-runc that provide CAP_SYS_ADMIN but don't include iproute2
• Custom sandbox environments with limited userspace tools

Solution

Replaced all ip command invocations with direct syscalls and netlink operations using the rtnetlink and nix crates. The implementation now:

1. Network namespace management: Uses unshare() + bind-mount instead of ip netns add/del
2. Veth pair creation: Uses rtnetlink instead of ip link add
3. Interface configuration: Uses rtnetlink for IP addresses and link state instead of ip addr and ip link set
4. Namespace execution: Uses setns() + fork()/exec() instead of ip netns exec

Changes

New Module: src/jail/linux/netlink.rs

• create_netns() / delete_netns(): Manage persistent namespaces
• create_veth_pair(): Create virtual ethernet pairs
• move_link_to_netns(): Move interfaces between namespaces
• set_link_up(): Configure link state
• add_addr(): Add IP addresses to interfaces
• add_default_route(): Add routing entries
• execute_in_netns(): Execute commands in namespaces with privilege dropping
• get_handle_in_netns(): Get netlink handle in a specific namespace

Updated Files

• src/jail/linux/resources.rs: Use netlink functions for namespace/veth resources
• src/jail/linux/mod.rs: Use netlink for all network configuration and command execution
• Cargo.toml: Add dependencies: rtnetlink, netlink-packet-route, futures, nix
• docs/guide/platform-support.md: Document container support and removed ip dependency

Testing

Built and tested successfully. The implementation:

• Maintains all existing functionality
• Works in environments without iproute2
• Still requires nft for nftables rules (documented requirement)
• Still requires CAP_SYS_ADMIN and CAP_NET_ADMIN (no change)

Benefits

1. Container compatibility: Works in minimal images and sysbox-runc
2. Smaller attack surface: Fewer external dependencies
3. Better error handling: Direct syscall errors vs parsing command output
4. Performance: No process spawning overhead for network operations
5. Maintainability: Pure Rust implementation

Breaking Changes

None. This is a drop-in replacement that maintains the same external behavior.

Documentation

Updated platform support documentation to note that iproute2 is no longer required and added examples for running inside containers (including sysbox-runc and Alpine).

[ammar-agent]

Fixes#74

Problem

httpjail failed when running inside Docker containers or minimal environments that don't include the iproute2 package (which provides the ip command). This affected users running httpjail in:

• Minimal container images (Alpine, distroless, etc.)
• Container runtimes like sysbox-runc that provide CAP_SYS_ADMIN but don't include iproute2
• Custom sandbox environments with limited userspace tools

Solution

Replaced all ip command invocations with direct syscalls and netlink operations using the rtnetlink and nix crates. The implementation now:

1. Network namespace management: Uses unshare() + bind-mount instead of ip netns add/del
2. Veth pair creation: Uses rtnetlink instead of ip link add
3. Interface configuration: Uses rtnetlink for IP addresses and link state instead of ip addr and ip link set
4. Namespace execution: Uses setns() + fork()/exec() instead of ip netns exec

Changes

New Module: src/jail/linux/netlink.rs

• create_netns() / delete_netns(): Manage persistent namespaces
• create_veth_pair(): Create virtual ethernet pairs
• move_link_to_netns(): Move interfaces between namespaces
• set_link_up(): Configure link state
• add_addr(): Add IP addresses to interfaces
• add_default_route(): Add routing entries
• execute_in_netns(): Execute commands in namespaces with privilege dropping
• get_handle_in_netns(): Get netlink handle in a specific namespace

Updated Files

• src/jail/linux/resources.rs: Use netlink functions for namespace/veth resources
• src/jail/linux/mod.rs: Use netlink for all network configuration and command execution
• Cargo.toml: Add dependencies: rtnetlink, netlink-packet-route, futures, nix
• docs/guide/platform-support.md: Document container support and removed ip dependency

Testing

Built and tested successfully. The implementation:

• Maintains all existing functionality
• Works in environments without iproute2
• Still requires nft for nftables rules (documented requirement)
• Still requires CAP_SYS_ADMIN and CAP_NET_ADMIN (no change)

Benefits

1. Container compatibility: Works in minimal images and sysbox-runc
2. Smaller attack surface: Fewer external dependencies
3. Better error handling: Direct syscall errors vs parsing command output
4. Performance: No process spawning overhead for network operations
5. Maintainability: Pure Rust implementation

Breaking Changes

None. This is a drop-in replacement that maintains the same external behavior.

Documentation

Updated platform support documentation to note that iproute2 is no longer required and added examples for running inside containers (including sysbox-runc and Alpine).

[ammar-agent]

Fixes#74

Problem

httpjail failed when running inside Docker containers or minimal environments that don't include the iproute2 package (which provides the ip command). This affected users running httpjail in:

• Minimal container images (Alpine, distroless, etc.)
• Container runtimes like sysbox-runc that provide CAP_SYS_ADMIN but don't include iproute2
• Custom sandbox environments with limited userspace tools

Solution

Replaced all ip command invocations with direct syscalls and netlink operations using the rtnetlink and nix crates. The implementation now:

1. Network namespace management: Uses unshare() + bind-mount instead of ip netns add/del
2. Veth pair creation: Uses rtnetlink instead of ip link add
3. Interface configuration: Uses rtnetlink for IP addresses and link state instead of ip addr and ip link set
4. Namespace execution: Uses setns() + fork()/exec() instead of ip netns exec

Changes

New Module: src/jail/linux/netlink.rs

• create_netns() / delete_netns(): Manage persistent namespaces
• create_veth_pair(): Create virtual ethernet pairs
• move_link_to_netns(): Move interfaces between namespaces
• set_link_up(): Configure link state
• add_addr(): Add IP addresses to interfaces
• add_default_route(): Add routing entries
• execute_in_netns(): Execute commands in namespaces with privilege dropping
• get_handle_in_netns(): Get netlink handle in a specific namespace

Updated Files

• src/jail/linux/resources.rs: Use netlink functions for namespace/veth resources
• src/jail/linux/mod.rs: Use netlink for all network configuration and command execution
• Cargo.toml: Add dependencies: rtnetlink, netlink-packet-route, futures, nix
• docs/guide/platform-support.md: Document container support and removed ip dependency

Testing

Built and tested successfully. The implementation:

• Maintains all existing functionality
• Works in environments without iproute2
• Still requires nft for nftables rules (documented requirement)
• Still requires CAP_SYS_ADMIN and CAP_NET_ADMIN (no change)

Benefits

1. Container compatibility: Works in minimal images and sysbox-runc
2. Smaller attack surface: Fewer external dependencies
3. Better error handling: Direct syscall errors vs parsing command output
4. Performance: No process spawning overhead for network operations
5. Maintainability: Pure Rust implementation

Breaking Changes

None. This is a drop-in replacement that maintains the same external behavior.

Documentation

Updated platform support documentation to note that iproute2 is no longer required and added examples for running inside containers (including sysbox-runc and Alpine).

[ammar-agent]

Fixes#74

Problem

httpjail failed when running inside Docker containers or minimal environments that don't include the iproute2 package (which provides the ip command). This affected users running httpjail in:

• Minimal container images (Alpine, distroless, etc.)
• Container runtimes like sysbox-runc that provide CAP_SYS_ADMIN but don't include iproute2
• Custom sandbox environments with limited userspace tools

Solution

Replaced all ip command invocations with direct syscalls and netlink operations using the rtnetlink and nix crates. The implementation now:

1. Network namespace management: Uses unshare() + bind-mount instead of ip netns add/del
2. Veth pair creation: Uses rtnetlink instead of ip link add
3. Interface configuration: Uses rtnetlink for IP addresses and link state instead of ip addr and ip link set
4. Namespace execution: Uses setns() + fork()/exec() instead of ip netns exec

Changes

New Module: src/jail/linux/netlink.rs

• create_netns() / delete_netns(): Manage persistent namespaces
• create_veth_pair(): Create virtual ethernet pairs
• move_link_to_netns(): Move interfaces between namespaces
• set_link_up(): Configure link state
• add_addr(): Add IP addresses to interfaces
• add_default_route(): Add routing entries
• execute_in_netns(): Execute commands in namespaces with privilege dropping
• get_handle_in_netns(): Get netlink handle in a specific namespace

Updated Files

• src/jail/linux/resources.rs: Use netlink functions for namespace/veth resources
• src/jail/linux/mod.rs: Use netlink for all network configuration and command execution
• Cargo.toml: Add dependencies: rtnetlink, netlink-packet-route, futures, nix
• docs/guide/platform-support.md: Document container support and removed ip dependency

Testing

Built and tested successfully. The implementation:

• Maintains all existing functionality
• Works in environments without iproute2
• Still requires nft for nftables rules (documented requirement)
• Still requires CAP_SYS_ADMIN and CAP_NET_ADMIN (no change)

Benefits

1. Container compatibility: Works in minimal images and sysbox-runc
2. Smaller attack surface: Fewer external dependencies
3. Better error handling: Direct syscall errors vs parsing command output
4. Performance: No process spawning overhead for network operations
5. Maintainability: Pure Rust implementation

Breaking Changes

None. This is a drop-in replacement that maintains the same external behavior.

Documentation

Updated platform support documentation to note that iproute2 is no longer required and added examples for running inside containers (including sysbox-runc and Alpine).

[ammar-agent]

Fixes#74

Problem

httpjail failed when running inside Docker containers or minimal environments that don't include the iproute2 package (which provides the ip command). This affected users running httpjail in:

• Minimal container images (Alpine, distroless, etc.)
• Container runtimes like sysbox-runc that provide CAP_SYS_ADMIN but don't include iproute2
• Custom sandbox environments with limited userspace tools

Solution

Replaced all ip command invocations with direct syscalls and netlink operations using the rtnetlink and nix crates. The implementation now:

1. Network namespace management: Uses unshare() + bind-mount instead of ip netns add/del
2. Veth pair creation: Uses rtnetlink instead of ip link add
3. Interface configuration: Uses rtnetlink for IP addresses and link state instead of ip addr and ip link set
4. Namespace execution: Uses setns() + fork()/exec() instead of ip netns exec

Changes

New Module: src/jail/linux/netlink.rs

• create_netns() / delete_netns(): Manage persistent namespaces
• create_veth_pair(): Create virtual ethernet pairs
• move_link_to_netns(): Move interfaces between namespaces
• set_link_up(): Configure link state
• add_addr(): Add IP addresses to interfaces
• add_default_route(): Add routing entries
• execute_in_netns(): Execute commands in namespaces with privilege dropping
• get_handle_in_netns(): Get netlink handle in a specific namespace

Updated Files

• src/jail/linux/resources.rs: Use netlink functions for namespace/veth resources
• src/jail/linux/mod.rs: Use netlink for all network configuration and command execution
• Cargo.toml: Add dependencies: rtnetlink, netlink-packet-route, futures, nix
• docs/guide/platform-support.md: Document container support and removed ip dependency

Testing

Built and tested successfully. The implementation:

• Maintains all existing functionality
• Works in environments without iproute2
• Still requires nft for nftables rules (documented requirement)
• Still requires CAP_SYS_ADMIN and CAP_NET_ADMIN (no change)

Benefits

1. Container compatibility: Works in minimal images and sysbox-runc
2. Smaller attack surface: Fewer external dependencies
3. Better error handling: Direct syscall errors vs parsing command output
4. Performance: No process spawning overhead for network operations
5. Maintainability: Pure Rust implementation

Breaking Changes

None. This is a drop-in replacement that maintains the same external behavior.

Documentation

Updated platform support documentation to note that iproute2 is no longer required and added examples for running inside containers (including sysbox-runc and Alpine).

[ammar-agent]

Fixes#74

Problem

httpjail failed when running inside Docker containers or minimal environments that don't include the iproute2 package (which provides the ip command). This affected users running httpjail in:

• Minimal container images (Alpine, distroless, etc.)
• Container runtimes like sysbox-runc that provide CAP_SYS_ADMIN but don't include iproute2
• Custom sandbox environments with limited userspace tools

Solution

Replaced all ip command invocations with direct syscalls and netlink operations using the rtnetlink and nix crates. The implementation now:

1. Network namespace management: Uses unshare() + bind-mount instead of ip netns add/del
2. Veth pair creation: Uses rtnetlink instead of ip link add
3. Interface configuration: Uses rtnetlink for IP addresses and link state instead of ip addr and ip link set
4. Namespace execution: Uses setns() + fork()/exec() instead of ip netns exec

Changes

New Module: src/jail/linux/netlink.rs

• create_netns() / delete_netns(): Manage persistent namespaces
• create_veth_pair(): Create virtual ethernet pairs
• move_link_to_netns(): Move interfaces between namespaces
• set_link_up(): Configure link state
• add_addr(): Add IP addresses to interfaces
• add_default_route(): Add routing entries
• execute_in_netns(): Execute commands in namespaces with privilege dropping
• get_handle_in_netns(): Get netlink handle in a specific namespace

Updated Files

• src/jail/linux/resources.rs: Use netlink functions for namespace/veth resources
• src/jail/linux/mod.rs: Use netlink for all network configuration and command execution
• Cargo.toml: Add dependencies: rtnetlink, netlink-packet-route, futures, nix
• docs/guide/platform-support.md: Document container support and removed ip dependency

Testing

Built and tested successfully. The implementation:

• Maintains all existing functionality
• Works in environments without iproute2
• Still requires nft for nftables rules (documented requirement)
• Still requires CAP_SYS_ADMIN and CAP_NET_ADMIN (no change)

Benefits

1. Container compatibility: Works in minimal images and sysbox-runc
2. Smaller attack surface: Fewer external dependencies
3. Better error handling: Direct syscall errors vs parsing command output
4. Performance: No process spawning overhead for network operations
5. Maintainability: Pure Rust implementation

Breaking Changes

None. This is a drop-in replacement that maintains the same external behavior.

Documentation

Updated platform support documentation to note that iproute2 is no longer required and added examples for running inside containers (including sysbox-runc and Alpine).

[ammar-agent]

Fixes#74

Problem

httpjail failed when running inside Docker containers or minimal environments that don't include the iproute2 package (which provides the ip command). This affected users running httpjail in:

• Minimal container images (Alpine, distroless, etc.)
• Container runtimes like sysbox-runc that provide CAP_SYS_ADMIN but don't include iproute2
• Custom sandbox environments with limited userspace tools

Solution

Replaced all ip command invocations with direct syscalls and netlink operations using the rtnetlink and nix crates. The implementation now:

1. Network namespace management: Uses unshare() + bind-mount instead of ip netns add/del
2. Veth pair creation: Uses rtnetlink instead of ip link add
3. Interface configuration: Uses rtnetlink for IP addresses and link state instead of ip addr and ip link set
4. Namespace execution: Uses setns() + fork()/exec() instead of ip netns exec

Changes

New Module: src/jail/linux/netlink.rs

• create_netns() / delete_netns(): Manage persistent namespaces
• create_veth_pair(): Create virtual ethernet pairs
• move_link_to_netns(): Move interfaces between namespaces
• set_link_up(): Configure link state
• add_addr(): Add IP addresses to interfaces
• add_default_route(): Add routing entries
• execute_in_netns(): Execute commands in namespaces with privilege dropping
• get_handle_in_netns(): Get netlink handle in a specific namespace

Updated Files

• src/jail/linux/resources.rs: Use netlink functions for namespace/veth resources
• src/jail/linux/mod.rs: Use netlink for all network configuration and command execution
• Cargo.toml: Add dependencies: rtnetlink, netlink-packet-route, futures, nix
• docs/guide/platform-support.md: Document container support and removed ip dependency

Testing

Built and tested successfully. The implementation:

• Maintains all existing functionality
• Works in environments without iproute2
• Still requires nft for nftables rules (documented requirement)
• Still requires CAP_SYS_ADMIN and CAP_NET_ADMIN (no change)

Benefits

1. Container compatibility: Works in minimal images and sysbox-runc
2. Smaller attack surface: Fewer external dependencies
3. Better error handling: Direct syscall errors vs parsing command output
4. Performance: No process spawning overhead for network operations
5. Maintainability: Pure Rust implementation

Breaking Changes

None. This is a drop-in replacement that maintains the same external behavior.

Documentation

Updated platform support documentation to note that iproute2 is no longer required and added examples for running inside containers (including sysbox-runc and Alpine).

[ammar-agent]

Fixes#74

Problem

httpjail failed when running inside Docker containers or minimal environments that don't include the iproute2 package (which provides the ip command). This affected users running httpjail in:

• Minimal container images (Alpine, distroless, etc.)
• Container runtimes like sysbox-runc that provide CAP_SYS_ADMIN but don't include iproute2
• Custom sandbox environments with limited userspace tools

Solution

Replaced all ip command invocations with direct syscalls and netlink operations using the rtnetlink and nix crates. The implementation now:

1. Network namespace management: Uses unshare() + bind-mount instead of ip netns add/del
2. Veth pair creation: Uses rtnetlink instead of ip link add
3. Interface configuration: Uses rtnetlink for IP addresses and link state instead of ip addr and ip link set
4. Namespace execution: Uses setns() + fork()/exec() instead of ip netns exec

Changes

New Module: src/jail/linux/netlink.rs

• create_netns() / delete_netns(): Manage persistent namespaces
• create_veth_pair(): Create virtual ethernet pairs
• move_link_to_netns(): Move interfaces between namespaces
• set_link_up(): Configure link state
• add_addr(): Add IP addresses to interfaces
• add_default_route(): Add routing entries
• execute_in_netns(): Execute commands in namespaces with privilege dropping
• get_handle_in_netns(): Get netlink handle in a specific namespace

Updated Files

• src/jail/linux/resources.rs: Use netlink functions for namespace/veth resources
• src/jail/linux/mod.rs: Use netlink for all network configuration and command execution
• Cargo.toml: Add dependencies: rtnetlink, netlink-packet-route, futures, nix
• docs/guide/platform-support.md: Document container support and removed ip dependency

Testing

Built and tested successfully. The implementation:

• Maintains all existing functionality
• Works in environments without iproute2
• Still requires nft for nftables rules (documented requirement)
• Still requires CAP_SYS_ADMIN and CAP_NET_ADMIN (no change)

Benefits

1. Container compatibility: Works in minimal images and sysbox-runc
2. Smaller attack surface: Fewer external dependencies
3. Better error handling: Direct syscall errors vs parsing command output
4. Performance: No process spawning overhead for network operations
5. Maintainability: Pure Rust implementation

Breaking Changes

None. This is a drop-in replacement that maintains the same external behavior.

Documentation

Updated platform support documentation to note that iproute2 is no longer required and added examples for running inside containers (including sysbox-runc and Alpine).