Support iptables-like filtering

[sirdarckcat]

Seems like it's possible to do ip packet filtering inside network namespaces. Not sure how something like this could be implemented, so just throwing it out there as an idea.

https://github.com/deitch/ctables/blob/master/ctables
https://stackoverflow.com/questions/35695840/iptables-not-working-on-macvlan-traffic-in-container

[sirdarckcat]

(I was looking into this to limit the bandwidth used by the contained service)

[juliangruber]

Maybe filtering on a syscall level could work for this, using https://github.com/google/kafel?

Otherwise I'd think you'd need to create a new virtual interface, add iptable rules, and then pass that to the jailed process.

[sirdarckcat]

Hmm interesting. @happyCoder92 WDYT?

[juliangruber]

Keep in mind that when passing a virtual interface you need to use sudo