Skip to content

fix: Remove dependency on ip command for container support#78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ammar-agent wants to merge 13 commits into
base:main
Choose a base branch
from
Open

fix: Remove dependency on ip command for container support #78

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
f5d471c
fix: Remove dependency on `ip` command for container support
ammar-agent Oct 9, 2025
b1c6237
refactor: Simplify netlink code and restore docs
ammar-agent Oct 9, 2025
e190c92
fix: CI compilation errors
ammar-agent Oct 9, 2025
5f9991e
fix: Avoid nested tokio runtimes in tests
ammar-agent Oct 9, 2025
3386733
fix: Clone strings before passing to block_on
ammar-agent Oct 9, 2025
e47fc5e
chore: rework tokio runtime helper and validate command early
ammar-agent Oct 9, 2025
2fa075c
fix: Add move keyword to async blocks
ammar-agent Oct 10, 2025
451449a
fix: Add move to configure_host_networking async block
ammar-agent Oct 10, 2025
c915816
fix: Clone veth_host for debug message
ammar-agent Oct 10, 2025
50d782a
fix: Remove DNS check that pollutes stdout
ammar-agent Oct 10, 2025
3308c55
fix: Remove unused with_netns function
ammar-agent Oct 10, 2025
2787179
fix: Add better error logging for DNS configuration
ammar-agent Oct 10, 2025
d325803
fix: Use bind-mount for DNS instead of echo redirection
ammar-agent Oct 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
127 changes: 127 additions & 0 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 4 additions & 0 deletions Cargo.toml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -50,6 +50,10 @@ atty = "0.2"
[target.'cfg(target_os = "linux")'.dependencies]
libc = "0.2"
socket2 = "0.5"
rtnetlink = "0.14"
netlink-packet-route = "0.19"
futures = "0.3"
nix = { version = "0.29", features = ["mount", "sched"] }

[dev-dependencies]
tempfile = "3.8"
Expand Down
57 changes: 57 additions & 0 deletions docs/guide/platform-support.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -42,6 +42,9 @@ Full network isolation using namespaces and nftables.
- nftables (`nft` command)
- libssl-dev (for TLS)
- sudo access (for namespace creation)
- CAP_SYS_ADMIN and CAP_NET_ADMIN capabilities (automatically available with sudo, or in privileged containers)

**Note:** httpjail no longer requires the `ip` command from `iproute2`. It uses direct syscalls and netlink for all network namespace operations. This allows it to work in minimal container images (like Alpine) or container runtimes like sysbox that provide the necessary capabilities but don't include the `iproute2` package.

### How It Works

Expand All@@ -60,6 +63,39 @@ sudo httpjail --js "r.host === 'github.com'" -- curl https://api.github.com
httpjail --weak --js "r.host === 'github.com'" -- curl https://api.github.com
```

### Running Inside Containers

httpjail works inside container environments (Docker, sysbox-runc, etc.) with proper capabilities:

```bash
# Docker with privileged mode (full capabilities)
docker run --privileged --rm -it alpine:latest sh -c '
wget https://github.com/coder/httpjail/releases/latest/download/httpjail-linux-amd64 -O /usr/local/bin/httpjail
chmod +x /usr/local/bin/httpjail
apk add --no-cache nftables
httpjail --js "r.host === \"example.com\"" -- wget -qO- https://example.com
'

# sysbox-runc (provides CAP_SYS_ADMIN automatically)
docker run --runtime=sysbox-runc --rm -it alpine:latest sh -c '
wget https://github.com/coder/httpjail/releases/latest/download/httpjail-linux-amd64 -O /usr/local/bin/httpjail
chmod +x /usr/local/bin/httpjail
apk add --no-cache nftables
httpjail --js "r.host === \"example.com\"" -- wget -qO- https://example.com
'

# Or use weak mode if you don't have the necessary capabilities
httpjail --weak --js "r.host === \"example.com\"" -- wget -qO- https://example.com
```

**Requirements for strong mode in containers:**
- CAP_SYS_ADMIN capability (for network namespace operations)
- CAP_NET_ADMIN capability (for network configuration)
- `nft` binary available (nftables)
- NO need for `iproute2` package

**Note:** Weak mode (`--weak`) works in any container but only sets HTTP_PROXY/HTTPS_PROXY environment variables, so applications must respect proxy settings.

## macOS

```
Expand DownExpand Up@@ -140,3 +176,24 @@ httpjail sets these variables for the child process to trust the CA certificate:
- `NODE_EXTRA_CA_CERTS` - Node.js
- `CARGO_HTTP_CAINFO` - Cargo
- `GIT_SSL_CAINFO` - Git

## Weak Mode

Weak mode is available on all platforms and uses environment variables only:

```bash
httpjail --weak --js "r.host === 'allowed.com'" -- your-app
```

**Characteristics:**
- ✅ No root/sudo required
- ✅ Works on all platforms
- ❌ Apps must respect HTTP_PROXY/HTTPS_PROXY
- ❌ Cannot enforce policy on non-compliant apps
- ⚠️ Lower security than strong mode

**Use weak mode when:**
- You don't have root access
- Testing on macOS (default behavior)
- Working with proxy-aware applications
- Running in containers without CAP_SYS_ADMIN
Loading
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
fix: Remove dependency on `ip` command for container support by ammar-agent · Pull Request #78 · coder/httpjail · GitHub
Skip to content
fix: Remove dependency on ip command for container support#78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Open

ammar-agent
wants to merge
13
commits into

base:main
Choose a base branch

from

 Open


fix: Remove dependency on ip command for container support
#78
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


13 commits


Select commit
Hold shift + click to select a range
f5d471c

fix: Remove dependency on `ip` command for container support


ammar-agent Oct 9, 2025
b1c6237

refactor: Simplify netlink code and restore docs


ammar-agent Oct 9, 2025
e190c92

fix: CI compilation errors


ammar-agent Oct 9, 2025
5f9991e

fix: Avoid nested tokio runtimes in tests


ammar-agent Oct 9, 2025
3386733

fix: Clone strings before passing to block_on


ammar-agent Oct 9, 2025
e47fc5e

chore: rework tokio runtime helper and validate command early


ammar-agent Oct 9, 2025
2fa075c

fix: Add move keyword to async blocks


ammar-agent Oct 10, 2025
451449a

fix: Add move to configure_host_networking async block


ammar-agent Oct 10, 2025
c915816

fix: Clone veth_host for debug message


ammar-agent Oct 10, 2025
50d782a

fix: Remove DNS check that pollutes stdout


ammar-agent Oct 10, 2025
3308c55

fix: Remove unused with_netns function


ammar-agent Oct 10, 2025
2787179

fix: Add better error logging for DNS configuration


ammar-agent Oct 10, 2025
d325803

fix: Use bind-mount for DNS instead of echo redirection


ammar-agent Oct 10, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


127 changes: 127 additions & 0 deletions
Cargo.lock

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


4 changes: 4 additions & 0 deletions
Cargo.toml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -50,6 +50,10 @@ atty = "0.2"
[target.'cfg(target_os = "linux")'.dependencies]
libc = "0.2"
socket2 = "0.5"
rtnetlink = "0.14"
netlink-packet-route = "0.19"
futures = "0.3"
nix = { version = "0.29", features = ["mount", "sched"] }

[dev-dependencies]
tempfile = "3.8"
Expand Down

57 changes: 57 additions & 0 deletions
docs/guide/platform-support.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -42,6 +42,9 @@ Full network isolation using namespaces and nftables.
- nftables (`nft` command)
- libssl-dev (for TLS)
- sudo access (for namespace creation)
- CAP_SYS_ADMIN and CAP_NET_ADMIN capabilities (automatically available with sudo, or in privileged containers)

**Note:** httpjail no longer requires the `ip` command from `iproute2`. It uses direct syscalls and netlink for all network namespace operations. This allows it to work in minimal container images (like Alpine) or container runtimes like sysbox that provide the necessary capabilities but don't include the `iproute2` package.

### How It Works

Expand All@@ -60,6 +63,39 @@ sudo httpjail --js "r.host === 'github.com'" -- curl https://api.github.com
httpjail --weak --js "r.host === 'github.com'" -- curl https://api.github.com
```

### Running Inside Containers

httpjail works inside container environments (Docker, sysbox-runc, etc.) with proper capabilities:

```bash
# Docker with privileged mode (full capabilities)
docker run --privileged --rm -it alpine:latest sh -c '
 wget https://github.com/coder/httpjail/releases/latest/download/httpjail-linux-amd64 -O /usr/local/bin/httpjail
 chmod +x /usr/local/bin/httpjail
 apk add --no-cache nftables
 httpjail --js "r.host === \"example.com\"" -- wget -qO- https://example.com
'

# sysbox-runc (provides CAP_SYS_ADMIN automatically)
docker run --runtime=sysbox-runc --rm -it alpine:latest sh -c '
 wget https://github.com/coder/httpjail/releases/latest/download/httpjail-linux-amd64 -O /usr/local/bin/httpjail
 chmod +x /usr/local/bin/httpjail
 apk add --no-cache nftables
 httpjail --js "r.host === \"example.com\"" -- wget -qO- https://example.com
'

# Or use weak mode if you don't have the necessary capabilities
httpjail --weak --js "r.host === \"example.com\"" -- wget -qO- https://example.com
```

**Requirements for strong mode in containers:**
- CAP_SYS_ADMIN capability (for network namespace operations)
- CAP_NET_ADMIN capability (for network configuration)
- `nft` binary available (nftables)
- NO need for `iproute2` package

**Note:** Weak mode (`--weak`) works in any container but only sets HTTP_PROXY/HTTPS_PROXY environment variables, so applications must respect proxy settings.

## macOS

```
Expand DownExpand Up@@ -140,3 +176,24 @@ httpjail sets these variables for the child process to trust the CA certificate:
- `NODE_EXTRA_CA_CERTS` - Node.js
- `CARGO_HTTP_CAINFO` - Cargo
- `GIT_SSL_CAINFO` - Git

## Weak Mode

Weak mode is available on all platforms and uses environment variables only:

```bash
httpjail --weak --js "r.host === 'allowed.com'" -- your-app
```

**Characteristics:**
- ✅ No root/sudo required
- ✅ Works on all platforms
- ❌ Apps must respect HTTP_PROXY/HTTPS_PROXY
- ❌ Cannot enforce policy on non-compliant apps
- ⚠️ Lower security than strong mode

**Use weak mode when:**
- You don't have root access
- Testing on macOS (default behavior)
- Working with proxy-aware applications
- Running in containers without CAP_SYS_ADMIN
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix: Remove dependency on `ip` command for container support by ammar-agent · Pull Request #78 · coder/httpjail · GitHub
Skip to content
fix: Remove dependency on ip command for container support#78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Open

ammar-agent
wants to merge
13
commits into

base:main
Choose a base branch

from

 Open


fix: Remove dependency on ip command for container support
#78
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


13 commits


Select commit
Hold shift + click to select a range
f5d471c

fix: Remove dependency on `ip` command for container support


ammar-agent Oct 9, 2025
b1c6237

refactor: Simplify netlink code and restore docs


ammar-agent Oct 9, 2025
e190c92

fix: CI compilation errors


ammar-agent Oct 9, 2025
5f9991e

fix: Avoid nested tokio runtimes in tests


ammar-agent Oct 9, 2025
3386733

fix: Clone strings before passing to block_on


ammar-agent Oct 9, 2025
e47fc5e

chore: rework tokio runtime helper and validate command early


ammar-agent Oct 9, 2025
2fa075c

fix: Add move keyword to async blocks


ammar-agent Oct 10, 2025
451449a

fix: Add move to configure_host_networking async block


ammar-agent Oct 10, 2025
c915816

fix: Clone veth_host for debug message


ammar-agent Oct 10, 2025
50d782a

fix: Remove DNS check that pollutes stdout


ammar-agent Oct 10, 2025
3308c55

fix: Remove unused with_netns function


ammar-agent Oct 10, 2025
2787179

fix: Add better error logging for DNS configuration


ammar-agent Oct 10, 2025
d325803

fix: Use bind-mount for DNS instead of echo redirection


ammar-agent Oct 10, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


127 changes: 127 additions & 0 deletions
Cargo.lock

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


4 changes: 4 additions & 0 deletions
Cargo.toml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -50,6 +50,10 @@ atty = "0.2"
[target.'cfg(target_os = "linux")'.dependencies]
libc = "0.2"
socket2 = "0.5"
rtnetlink = "0.14"
netlink-packet-route = "0.19"
futures = "0.3"
nix = { version = "0.29", features = ["mount", "sched"] }

[dev-dependencies]
tempfile = "3.8"
Expand Down

57 changes: 57 additions & 0 deletions
docs/guide/platform-support.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -42,6 +42,9 @@ Full network isolation using namespaces and nftables.
- nftables (`nft` command)
- libssl-dev (for TLS)
- sudo access (for namespace creation)
- CAP_SYS_ADMIN and CAP_NET_ADMIN capabilities (automatically available with sudo, or in privileged containers)

**Note:** httpjail no longer requires the `ip` command from `iproute2`. It uses direct syscalls and netlink for all network namespace operations. This allows it to work in minimal container images (like Alpine) or container runtimes like sysbox that provide the necessary capabilities but don't include the `iproute2` package.

### How It Works

Expand All@@ -60,6 +63,39 @@ sudo httpjail --js "r.host === 'github.com'" -- curl https://api.github.com
httpjail --weak --js "r.host === 'github.com'" -- curl https://api.github.com
```

### Running Inside Containers

httpjail works inside container environments (Docker, sysbox-runc, etc.) with proper capabilities:

```bash
# Docker with privileged mode (full capabilities)
docker run --privileged --rm -it alpine:latest sh -c '
 wget https://github.com/coder/httpjail/releases/latest/download/httpjail-linux-amd64 -O /usr/local/bin/httpjail
 chmod +x /usr/local/bin/httpjail
 apk add --no-cache nftables
 httpjail --js "r.host === \"example.com\"" -- wget -qO- https://example.com
'

# sysbox-runc (provides CAP_SYS_ADMIN automatically)
docker run --runtime=sysbox-runc --rm -it alpine:latest sh -c '
 wget https://github.com/coder/httpjail/releases/latest/download/httpjail-linux-amd64 -O /usr/local/bin/httpjail
 chmod +x /usr/local/bin/httpjail
 apk add --no-cache nftables
 httpjail --js "r.host === \"example.com\"" -- wget -qO- https://example.com
'

# Or use weak mode if you don't have the necessary capabilities
httpjail --weak --js "r.host === \"example.com\"" -- wget -qO- https://example.com
```

**Requirements for strong mode in containers:**
- CAP_SYS_ADMIN capability (for network namespace operations)
- CAP_NET_ADMIN capability (for network configuration)
- `nft` binary available (nftables)
- NO need for `iproute2` package

**Note:** Weak mode (`--weak`) works in any container but only sets HTTP_PROXY/HTTPS_PROXY environment variables, so applications must respect proxy settings.

## macOS

```
Expand DownExpand Up@@ -140,3 +176,24 @@ httpjail sets these variables for the child process to trust the CA certificate:
- `NODE_EXTRA_CA_CERTS` - Node.js
- `CARGO_HTTP_CAINFO` - Cargo
- `GIT_SSL_CAINFO` - Git

## Weak Mode

Weak mode is available on all platforms and uses environment variables only:

```bash
httpjail --weak --js "r.host === 'allowed.com'" -- your-app
```

**Characteristics:**
- ✅ No root/sudo required
- ✅ Works on all platforms
- ❌ Apps must respect HTTP_PROXY/HTTPS_PROXY
- ❌ Cannot enforce policy on non-compliant apps
- ⚠️ Lower security than strong mode

**Use weak mode when:**
- You don't have root access
- Testing on macOS (default behavior)
- Working with proxy-aware applications
- Running in containers without CAP_SYS_ADMIN
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix: Remove dependency on `ip` command for container support by ammar-agent · Pull Request #78 · coder/httpjail · GitHub
Skip to content
fix: Remove dependency on ip command for container support#78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Open

ammar-agent
wants to merge
13
commits into

base:main
Choose a base branch

from

 Open


fix: Remove dependency on ip command for container support
#78
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


13 commits


Select commit
Hold shift + click to select a range
f5d471c

fix: Remove dependency on `ip` command for container support


ammar-agent Oct 9, 2025
b1c6237

refactor: Simplify netlink code and restore docs


ammar-agent Oct 9, 2025
e190c92

fix: CI compilation errors


ammar-agent Oct 9, 2025
5f9991e

fix: Avoid nested tokio runtimes in tests


ammar-agent Oct 9, 2025
3386733

fix: Clone strings before passing to block_on


ammar-agent Oct 9, 2025
e47fc5e

chore: rework tokio runtime helper and validate command early


ammar-agent Oct 9, 2025
2fa075c

fix: Add move keyword to async blocks


ammar-agent Oct 10, 2025
451449a

fix: Add move to configure_host_networking async block


ammar-agent Oct 10, 2025
c915816

fix: Clone veth_host for debug message


ammar-agent Oct 10, 2025
50d782a

fix: Remove DNS check that pollutes stdout


ammar-agent Oct 10, 2025
3308c55

fix: Remove unused with_netns function


ammar-agent Oct 10, 2025
2787179

fix: Add better error logging for DNS configuration


ammar-agent Oct 10, 2025
d325803

fix: Use bind-mount for DNS instead of echo redirection


ammar-agent Oct 10, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


127 changes: 127 additions & 0 deletions
Cargo.lock

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


4 changes: 4 additions & 0 deletions
Cargo.toml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -50,6 +50,10 @@ atty = "0.2"
[target.'cfg(target_os = "linux")'.dependencies]
libc = "0.2"
socket2 = "0.5"
rtnetlink = "0.14"
netlink-packet-route = "0.19"
futures = "0.3"
nix = { version = "0.29", features = ["mount", "sched"] }

[dev-dependencies]
tempfile = "3.8"
Expand Down

57 changes: 57 additions & 0 deletions
docs/guide/platform-support.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -42,6 +42,9 @@ Full network isolation using namespaces and nftables.
- nftables (`nft` command)
- libssl-dev (for TLS)
- sudo access (for namespace creation)
- CAP_SYS_ADMIN and CAP_NET_ADMIN capabilities (automatically available with sudo, or in privileged containers)

**Note:** httpjail no longer requires the `ip` command from `iproute2`. It uses direct syscalls and netlink for all network namespace operations. This allows it to work in minimal container images (like Alpine) or container runtimes like sysbox that provide the necessary capabilities but don't include the `iproute2` package.

### How It Works

Expand All@@ -60,6 +63,39 @@ sudo httpjail --js "r.host === 'github.com'" -- curl https://api.github.com
httpjail --weak --js "r.host === 'github.com'" -- curl https://api.github.com
```

### Running Inside Containers

httpjail works inside container environments (Docker, sysbox-runc, etc.) with proper capabilities:

```bash
# Docker with privileged mode (full capabilities)
docker run --privileged --rm -it alpine:latest sh -c '
 wget https://github.com/coder/httpjail/releases/latest/download/httpjail-linux-amd64 -O /usr/local/bin/httpjail
 chmod +x /usr/local/bin/httpjail
 apk add --no-cache nftables
 httpjail --js "r.host === \"example.com\"" -- wget -qO- https://example.com
'

# sysbox-runc (provides CAP_SYS_ADMIN automatically)
docker run --runtime=sysbox-runc --rm -it alpine:latest sh -c '
 wget https://github.com/coder/httpjail/releases/latest/download/httpjail-linux-amd64 -O /usr/local/bin/httpjail
 chmod +x /usr/local/bin/httpjail
 apk add --no-cache nftables
 httpjail --js "r.host === \"example.com\"" -- wget -qO- https://example.com
'

# Or use weak mode if you don't have the necessary capabilities
httpjail --weak --js "r.host === \"example.com\"" -- wget -qO- https://example.com
```

**Requirements for strong mode in containers:**
- CAP_SYS_ADMIN capability (for network namespace operations)
- CAP_NET_ADMIN capability (for network configuration)
- `nft` binary available (nftables)
- NO need for `iproute2` package

**Note:** Weak mode (`--weak`) works in any container but only sets HTTP_PROXY/HTTPS_PROXY environment variables, so applications must respect proxy settings.

## macOS

```
Expand DownExpand Up@@ -140,3 +176,24 @@ httpjail sets these variables for the child process to trust the CA certificate:
- `NODE_EXTRA_CA_CERTS` - Node.js
- `CARGO_HTTP_CAINFO` - Cargo
- `GIT_SSL_CAINFO` - Git

## Weak Mode

Weak mode is available on all platforms and uses environment variables only:

```bash
httpjail --weak --js "r.host === 'allowed.com'" -- your-app
```

**Characteristics:**
- ✅ No root/sudo required
- ✅ Works on all platforms
- ❌ Apps must respect HTTP_PROXY/HTTPS_PROXY
- ❌ Cannot enforce policy on non-compliant apps
- ⚠️ Lower security than strong mode

**Use weak mode when:**
- You don't have root access
- Testing on macOS (default behavior)
- Working with proxy-aware applications
- Running in containers without CAP_SYS_ADMIN
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
fix: Remove dependency on `ip` command for container support by ammar-agent · Pull Request #78 · coder/httpjail · GitHub
Skip to content
fix: Remove dependency on ip command for container support#78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Open

ammar-agent
wants to merge
13
commits into

base:main
Choose a base branch

from

 Open


fix: Remove dependency on ip command for container support
#78
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


13 commits


Select commit
Hold shift + click to select a range
f5d471c

fix: Remove dependency on `ip` command for container support


ammar-agent Oct 9, 2025
b1c6237

refactor: Simplify netlink code and restore docs


ammar-agent Oct 9, 2025
e190c92

fix: CI compilation errors


ammar-agent Oct 9, 2025
5f9991e

fix: Avoid nested tokio runtimes in tests


ammar-agent Oct 9, 2025
3386733

fix: Clone strings before passing to block_on


ammar-agent Oct 9, 2025
e47fc5e

chore: rework tokio runtime helper and validate command early


ammar-agent Oct 9, 2025
2fa075c

fix: Add move keyword to async blocks


ammar-agent Oct 10, 2025
451449a

fix: Add move to configure_host_networking async block


ammar-agent Oct 10, 2025
c915816

fix: Clone veth_host for debug message


ammar-agent Oct 10, 2025
50d782a

fix: Remove DNS check that pollutes stdout


ammar-agent Oct 10, 2025
3308c55

fix: Remove unused with_netns function


ammar-agent Oct 10, 2025
2787179

fix: Add better error logging for DNS configuration


ammar-agent Oct 10, 2025
d325803

fix: Use bind-mount for DNS instead of echo redirection


ammar-agent Oct 10, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


127 changes: 127 additions & 0 deletions
Cargo.lock

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


4 changes: 4 additions & 0 deletions
Cargo.toml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -50,6 +50,10 @@ atty = "0.2"
[target.'cfg(target_os = "linux")'.dependencies]
libc = "0.2"
socket2 = "0.5"
rtnetlink = "0.14"
netlink-packet-route = "0.19"
futures = "0.3"
nix = { version = "0.29", features = ["mount", "sched"] }

[dev-dependencies]
tempfile = "3.8"
Expand Down

57 changes: 57 additions & 0 deletions
docs/guide/platform-support.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -42,6 +42,9 @@ Full network isolation using namespaces and nftables.
- nftables (`nft` command)
- libssl-dev (for TLS)
- sudo access (for namespace creation)
- CAP_SYS_ADMIN and CAP_NET_ADMIN capabilities (automatically available with sudo, or in privileged containers)

**Note:** httpjail no longer requires the `ip` command from `iproute2`. It uses direct syscalls and netlink for all network namespace operations. This allows it to work in minimal container images (like Alpine) or container runtimes like sysbox that provide the necessary capabilities but don't include the `iproute2` package.

### How It Works

Expand All@@ -60,6 +63,39 @@ sudo httpjail --js "r.host === 'github.com'" -- curl https://api.github.com
httpjail --weak --js "r.host === 'github.com'" -- curl https://api.github.com
```

### Running Inside Containers

httpjail works inside container environments (Docker, sysbox-runc, etc.) with proper capabilities:

```bash
# Docker with privileged mode (full capabilities)
docker run --privileged --rm -it alpine:latest sh -c '
 wget https://github.com/coder/httpjail/releases/latest/download/httpjail-linux-amd64 -O /usr/local/bin/httpjail
 chmod +x /usr/local/bin/httpjail
 apk add --no-cache nftables
 httpjail --js "r.host === \"example.com\"" -- wget -qO- https://example.com
'

# sysbox-runc (provides CAP_SYS_ADMIN automatically)
docker run --runtime=sysbox-runc --rm -it alpine:latest sh -c '
 wget https://github.com/coder/httpjail/releases/latest/download/httpjail-linux-amd64 -O /usr/local/bin/httpjail
 chmod +x /usr/local/bin/httpjail
 apk add --no-cache nftables
 httpjail --js "r.host === \"example.com\"" -- wget -qO- https://example.com
'

# Or use weak mode if you don't have the necessary capabilities
httpjail --weak --js "r.host === \"example.com\"" -- wget -qO- https://example.com
```

**Requirements for strong mode in containers:**
- CAP_SYS_ADMIN capability (for network namespace operations)
- CAP_NET_ADMIN capability (for network configuration)
- `nft` binary available (nftables)
- NO need for `iproute2` package

**Note:** Weak mode (`--weak`) works in any container but only sets HTTP_PROXY/HTTPS_PROXY environment variables, so applications must respect proxy settings.

## macOS

```
Expand DownExpand Up@@ -140,3 +176,24 @@ httpjail sets these variables for the child process to trust the CA certificate:
- `NODE_EXTRA_CA_CERTS` - Node.js
- `CARGO_HTTP_CAINFO` - Cargo
- `GIT_SSL_CAINFO` - Git

## Weak Mode

Weak mode is available on all platforms and uses environment variables only:

```bash
httpjail --weak --js "r.host === 'allowed.com'" -- your-app
```

**Characteristics:**
- ✅ No root/sudo required
- ✅ Works on all platforms
- ❌ Apps must respect HTTP_PROXY/HTTPS_PROXY
- ❌ Cannot enforce policy on non-compliant apps
- ⚠️ Lower security than strong mode

**Use weak mode when:**
- You don't have root access
- Testing on macOS (default behavior)
- Working with proxy-aware applications
- Running in containers without CAP_SYS_ADMIN
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix: Remove dependency on `ip` command for container support by ammar-agent · Pull Request #78 · coder/httpjail · GitHub
Skip to content
fix: Remove dependency on ip command for container support#78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Open

ammar-agent
wants to merge
13
commits into

base:main
Choose a base branch

from

 Open


fix: Remove dependency on ip command for container support
#78
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


13 commits


Select commit
Hold shift + click to select a range
f5d471c

fix: Remove dependency on `ip` command for container support


ammar-agent Oct 9, 2025
b1c6237

refactor: Simplify netlink code and restore docs


ammar-agent Oct 9, 2025
e190c92

fix: CI compilation errors


ammar-agent Oct 9, 2025
5f9991e

fix: Avoid nested tokio runtimes in tests


ammar-agent Oct 9, 2025
3386733

fix: Clone strings before passing to block_on


ammar-agent Oct 9, 2025
e47fc5e

chore: rework tokio runtime helper and validate command early


ammar-agent Oct 9, 2025
2fa075c

fix: Add move keyword to async blocks


ammar-agent Oct 10, 2025
451449a

fix: Add move to configure_host_networking async block


ammar-agent Oct 10, 2025
c915816

fix: Clone veth_host for debug message


ammar-agent Oct 10, 2025
50d782a

fix: Remove DNS check that pollutes stdout


ammar-agent Oct 10, 2025
3308c55

fix: Remove unused with_netns function


ammar-agent Oct 10, 2025
2787179

fix: Add better error logging for DNS configuration


ammar-agent Oct 10, 2025
d325803

fix: Use bind-mount for DNS instead of echo redirection


ammar-agent Oct 10, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


127 changes: 127 additions & 0 deletions
Cargo.lock

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


4 changes: 4 additions & 0 deletions
Cargo.toml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -50,6 +50,10 @@ atty = "0.2"
[target.'cfg(target_os = "linux")'.dependencies]
libc = "0.2"
socket2 = "0.5"
rtnetlink = "0.14"
netlink-packet-route = "0.19"
futures = "0.3"
nix = { version = "0.29", features = ["mount", "sched"] }

[dev-dependencies]
tempfile = "3.8"
Expand Down

57 changes: 57 additions & 0 deletions
docs/guide/platform-support.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -42,6 +42,9 @@ Full network isolation using namespaces and nftables.
- nftables (`nft` command)
- libssl-dev (for TLS)
- sudo access (for namespace creation)
- CAP_SYS_ADMIN and CAP_NET_ADMIN capabilities (automatically available with sudo, or in privileged containers)

**Note:** httpjail no longer requires the `ip` command from `iproute2`. It uses direct syscalls and netlink for all network namespace operations. This allows it to work in minimal container images (like Alpine) or container runtimes like sysbox that provide the necessary capabilities but don't include the `iproute2` package.

### How It Works

Expand All@@ -60,6 +63,39 @@ sudo httpjail --js "r.host === 'github.com'" -- curl https://api.github.com
httpjail --weak --js "r.host === 'github.com'" -- curl https://api.github.com
```

### Running Inside Containers

httpjail works inside container environments (Docker, sysbox-runc, etc.) with proper capabilities:

```bash
# Docker with privileged mode (full capabilities)
docker run --privileged --rm -it alpine:latest sh -c '
 wget https://github.com/coder/httpjail/releases/latest/download/httpjail-linux-amd64 -O /usr/local/bin/httpjail
 chmod +x /usr/local/bin/httpjail
 apk add --no-cache nftables
 httpjail --js "r.host === \"example.com\"" -- wget -qO- https://example.com
'

# sysbox-runc (provides CAP_SYS_ADMIN automatically)
docker run --runtime=sysbox-runc --rm -it alpine:latest sh -c '
 wget https://github.com/coder/httpjail/releases/latest/download/httpjail-linux-amd64 -O /usr/local/bin/httpjail
 chmod +x /usr/local/bin/httpjail
 apk add --no-cache nftables
 httpjail --js "r.host === \"example.com\"" -- wget -qO- https://example.com
'

# Or use weak mode if you don't have the necessary capabilities
httpjail --weak --js "r.host === \"example.com\"" -- wget -qO- https://example.com
```

**Requirements for strong mode in containers:**
- CAP_SYS_ADMIN capability (for network namespace operations)
- CAP_NET_ADMIN capability (for network configuration)
- `nft` binary available (nftables)
- NO need for `iproute2` package

**Note:** Weak mode (`--weak`) works in any container but only sets HTTP_PROXY/HTTPS_PROXY environment variables, so applications must respect proxy settings.

## macOS

```
Expand DownExpand Up@@ -140,3 +176,24 @@ httpjail sets these variables for the child process to trust the CA certificate:
- `NODE_EXTRA_CA_CERTS` - Node.js
- `CARGO_HTTP_CAINFO` - Cargo
- `GIT_SSL_CAINFO` - Git

## Weak Mode

Weak mode is available on all platforms and uses environment variables only:

```bash
httpjail --weak --js "r.host === 'allowed.com'" -- your-app
```

**Characteristics:**
- ✅ No root/sudo required
- ✅ Works on all platforms
- ❌ Apps must respect HTTP_PROXY/HTTPS_PROXY
- ❌ Cannot enforce policy on non-compliant apps
- ⚠️ Lower security than strong mode

**Use weak mode when:**
- You don't have root access
- Testing on macOS (default behavior)
- Working with proxy-aware applications
- Running in containers without CAP_SYS_ADMIN
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix: Remove dependency on `ip` command for container support by ammar-agent · Pull Request #78 · coder/httpjail · GitHub
Skip to content
fix: Remove dependency on ip command for container support#78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Open

ammar-agent
wants to merge
13
commits into

base:main
Choose a base branch

from

 Open


fix: Remove dependency on ip command for container support
#78
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


13 commits


Select commit
Hold shift + click to select a range
f5d471c

fix: Remove dependency on `ip` command for container support


ammar-agent Oct 9, 2025
b1c6237

refactor: Simplify netlink code and restore docs


ammar-agent Oct 9, 2025
e190c92

fix: CI compilation errors


ammar-agent Oct 9, 2025
5f9991e

fix: Avoid nested tokio runtimes in tests


ammar-agent Oct 9, 2025
3386733

fix: Clone strings before passing to block_on


ammar-agent Oct 9, 2025
e47fc5e

chore: rework tokio runtime helper and validate command early


ammar-agent Oct 9, 2025
2fa075c

fix: Add move keyword to async blocks


ammar-agent Oct 10, 2025
451449a

fix: Add move to configure_host_networking async block


ammar-agent Oct 10, 2025
c915816

fix: Clone veth_host for debug message


ammar-agent Oct 10, 2025
50d782a

fix: Remove DNS check that pollutes stdout


ammar-agent Oct 10, 2025
3308c55

fix: Remove unused with_netns function


ammar-agent Oct 10, 2025
2787179

fix: Add better error logging for DNS configuration


ammar-agent Oct 10, 2025
d325803

fix: Use bind-mount for DNS instead of echo redirection


ammar-agent Oct 10, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


127 changes: 127 additions & 0 deletions
Cargo.lock

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


4 changes: 4 additions & 0 deletions
Cargo.toml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -50,6 +50,10 @@ atty = "0.2"
[target.'cfg(target_os = "linux")'.dependencies]
libc = "0.2"
socket2 = "0.5"
rtnetlink = "0.14"
netlink-packet-route = "0.19"
futures = "0.3"
nix = { version = "0.29", features = ["mount", "sched"] }

[dev-dependencies]
tempfile = "3.8"
Expand Down

57 changes: 57 additions & 0 deletions
docs/guide/platform-support.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -42,6 +42,9 @@ Full network isolation using namespaces and nftables.
- nftables (`nft` command)
- libssl-dev (for TLS)
- sudo access (for namespace creation)
- CAP_SYS_ADMIN and CAP_NET_ADMIN capabilities (automatically available with sudo, or in privileged containers)

**Note:** httpjail no longer requires the `ip` command from `iproute2`. It uses direct syscalls and netlink for all network namespace operations. This allows it to work in minimal container images (like Alpine) or container runtimes like sysbox that provide the necessary capabilities but don't include the `iproute2` package.

### How It Works

Expand All@@ -60,6 +63,39 @@ sudo httpjail --js "r.host === 'github.com'" -- curl https://api.github.com
httpjail --weak --js "r.host === 'github.com'" -- curl https://api.github.com
```

### Running Inside Containers

httpjail works inside container environments (Docker, sysbox-runc, etc.) with proper capabilities:

```bash
# Docker with privileged mode (full capabilities)
docker run --privileged --rm -it alpine:latest sh -c '
 wget https://github.com/coder/httpjail/releases/latest/download/httpjail-linux-amd64 -O /usr/local/bin/httpjail
 chmod +x /usr/local/bin/httpjail
 apk add --no-cache nftables
 httpjail --js "r.host === \"example.com\"" -- wget -qO- https://example.com
'

# sysbox-runc (provides CAP_SYS_ADMIN automatically)
docker run --runtime=sysbox-runc --rm -it alpine:latest sh -c '
 wget https://github.com/coder/httpjail/releases/latest/download/httpjail-linux-amd64 -O /usr/local/bin/httpjail
 chmod +x /usr/local/bin/httpjail
 apk add --no-cache nftables
 httpjail --js "r.host === \"example.com\"" -- wget -qO- https://example.com
'

# Or use weak mode if you don't have the necessary capabilities
httpjail --weak --js "r.host === \"example.com\"" -- wget -qO- https://example.com
```

**Requirements for strong mode in containers:**
- CAP_SYS_ADMIN capability (for network namespace operations)
- CAP_NET_ADMIN capability (for network configuration)
- `nft` binary available (nftables)
- NO need for `iproute2` package

**Note:** Weak mode (`--weak`) works in any container but only sets HTTP_PROXY/HTTPS_PROXY environment variables, so applications must respect proxy settings.

## macOS

```
Expand DownExpand Up@@ -140,3 +176,24 @@ httpjail sets these variables for the child process to trust the CA certificate:
- `NODE_EXTRA_CA_CERTS` - Node.js
- `CARGO_HTTP_CAINFO` - Cargo
- `GIT_SSL_CAINFO` - Git

## Weak Mode

Weak mode is available on all platforms and uses environment variables only:

```bash
httpjail --weak --js "r.host === 'allowed.com'" -- your-app
```

**Characteristics:**
- ✅ No root/sudo required
- ✅ Works on all platforms
- ❌ Apps must respect HTTP_PROXY/HTTPS_PROXY
- ❌ Cannot enforce policy on non-compliant apps
- ⚠️ Lower security than strong mode

**Use weak mode when:**
- You don't have root access
- Testing on macOS (default behavior)
- Working with proxy-aware applications
- Running in containers without CAP_SYS_ADMIN
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
fix: Remove dependency on `ip` command for container support by ammar-agent · Pull Request #78 · coder/httpjail · GitHub
Skip to content
fix: Remove dependency on ip command for container support#78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Open

ammar-agent
wants to merge
13
commits into

base:main
Choose a base branch

from

 Open


fix: Remove dependency on ip command for container support
#78
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


13 commits


Select commit
Hold shift + click to select a range
f5d471c

fix: Remove dependency on `ip` command for container support


ammar-agent Oct 9, 2025
b1c6237

refactor: Simplify netlink code and restore docs


ammar-agent Oct 9, 2025
e190c92

fix: CI compilation errors


ammar-agent Oct 9, 2025
5f9991e

fix: Avoid nested tokio runtimes in tests


ammar-agent Oct 9, 2025
3386733

fix: Clone strings before passing to block_on


ammar-agent Oct 9, 2025
e47fc5e

chore: rework tokio runtime helper and validate command early


ammar-agent Oct 9, 2025
2fa075c

fix: Add move keyword to async blocks


ammar-agent Oct 10, 2025
451449a

fix: Add move to configure_host_networking async block


ammar-agent Oct 10, 2025
c915816

fix: Clone veth_host for debug message


ammar-agent Oct 10, 2025
50d782a

fix: Remove DNS check that pollutes stdout


ammar-agent Oct 10, 2025
3308c55

fix: Remove unused with_netns function


ammar-agent Oct 10, 2025
2787179

fix: Add better error logging for DNS configuration


ammar-agent Oct 10, 2025
d325803

fix: Use bind-mount for DNS instead of echo redirection


ammar-agent Oct 10, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


127 changes: 127 additions & 0 deletions
Cargo.lock

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


4 changes: 4 additions & 0 deletions
Cargo.toml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -50,6 +50,10 @@ atty = "0.2"
[target.'cfg(target_os = "linux")'.dependencies]
libc = "0.2"
socket2 = "0.5"
rtnetlink = "0.14"
netlink-packet-route = "0.19"
futures = "0.3"
nix = { version = "0.29", features = ["mount", "sched"] }

[dev-dependencies]
tempfile = "3.8"
Expand Down

57 changes: 57 additions & 0 deletions
docs/guide/platform-support.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -42,6 +42,9 @@ Full network isolation using namespaces and nftables.
- nftables (`nft` command)
- libssl-dev (for TLS)
- sudo access (for namespace creation)
- CAP_SYS_ADMIN and CAP_NET_ADMIN capabilities (automatically available with sudo, or in privileged containers)

**Note:** httpjail no longer requires the `ip` command from `iproute2`. It uses direct syscalls and netlink for all network namespace operations. This allows it to work in minimal container images (like Alpine) or container runtimes like sysbox that provide the necessary capabilities but don't include the `iproute2` package.

### How It Works

Expand All@@ -60,6 +63,39 @@ sudo httpjail --js "r.host === 'github.com'" -- curl https://api.github.com
httpjail --weak --js "r.host === 'github.com'" -- curl https://api.github.com
```

### Running Inside Containers

httpjail works inside container environments (Docker, sysbox-runc, etc.) with proper capabilities:

```bash
# Docker with privileged mode (full capabilities)
docker run --privileged --rm -it alpine:latest sh -c '
 wget https://github.com/coder/httpjail/releases/latest/download/httpjail-linux-amd64 -O /usr/local/bin/httpjail
 chmod +x /usr/local/bin/httpjail
 apk add --no-cache nftables
 httpjail --js "r.host === \"example.com\"" -- wget -qO- https://example.com
'

# sysbox-runc (provides CAP_SYS_ADMIN automatically)
docker run --runtime=sysbox-runc --rm -it alpine:latest sh -c '
 wget https://github.com/coder/httpjail/releases/latest/download/httpjail-linux-amd64 -O /usr/local/bin/httpjail
 chmod +x /usr/local/bin/httpjail
 apk add --no-cache nftables
 httpjail --js "r.host === \"example.com\"" -- wget -qO- https://example.com
'

# Or use weak mode if you don't have the necessary capabilities
httpjail --weak --js "r.host === \"example.com\"" -- wget -qO- https://example.com
```

**Requirements for strong mode in containers:**
- CAP_SYS_ADMIN capability (for network namespace operations)
- CAP_NET_ADMIN capability (for network configuration)
- `nft` binary available (nftables)
- NO need for `iproute2` package

**Note:** Weak mode (`--weak`) works in any container but only sets HTTP_PROXY/HTTPS_PROXY environment variables, so applications must respect proxy settings.

## macOS

```
Expand DownExpand Up@@ -140,3 +176,24 @@ httpjail sets these variables for the child process to trust the CA certificate:
- `NODE_EXTRA_CA_CERTS` - Node.js
- `CARGO_HTTP_CAINFO` - Cargo
- `GIT_SSL_CAINFO` - Git

## Weak Mode

Weak mode is available on all platforms and uses environment variables only:

```bash
httpjail --weak --js "r.host === 'allowed.com'" -- your-app
```

**Characteristics:**
- ✅ No root/sudo required
- ✅ Works on all platforms
- ❌ Apps must respect HTTP_PROXY/HTTPS_PROXY
- ❌ Cannot enforce policy on non-compliant apps
- ⚠️ Lower security than strong mode

**Use weak mode when:**
- You don't have root access
- Testing on macOS (default behavior)
- Working with proxy-aware applications
- Running in containers without CAP_SYS_ADMIN
Loading
Loading