Privileged per-VM egress networking via the setuid helper's network
subcommands. The helper derives every address, interface name, and netns path
from vm_id + the validated uid + the root-owned [network] config — the
node passes only those two untrusted values.
Summary
Functions
Ensure the host-wide hyper nft table (masquerade + forward policy) exists. Idempotent.
Create vm_id's netns, veth pair, TAP, and NAT rules. Idempotent-safe on relaunch.
Remove vm_id's netns and host veth. Idempotent (a never-prepared VM is a no-op).
Remove vm_id's netns by id alone, with no uid — for the Reaper's
crashed-node backstop, where the owning node never persisted a uid to derive
the clone-pool slot from. Idempotent: a netns already gone (raced with a
normal teardown/2, or never fully created) is not an error.
Types
@type err() :: Hyper.SuidHelper.err()
Functions
@spec host_init() :: :ok | {:error, err()}
Ensure the host-wide hyper nft table (masquerade + forward policy) exists. Idempotent.
@spec prepare(Hyper.Vm.Id.t(), non_neg_integer()) :: :ok | {:error, err()}
Create vm_id's netns, veth pair, TAP, and NAT rules. Idempotent-safe on relaunch.
@spec teardown(Hyper.Vm.Id.t(), non_neg_integer()) :: :ok | {:error, err()}
Remove vm_id's netns and host veth. Idempotent (a never-prepared VM is a no-op).
@spec teardown_orphan(Hyper.Vm.Id.t()) :: :ok | {:error, err()}
Remove vm_id's netns by id alone, with no uid — for the Reaper's
crashed-node backstop, where the owning node never persisted a uid to derive
the clone-pool slot from. Idempotent: a netns already gone (raced with a
normal teardown/2, or never fully created) is not an error.