[PR #145] [CLOSED] fix(network): support iptables-legacy with CAP_NET_RAW #208

New issue

Closed

opened 2026-10-29 14:21:02 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-29 14:21:02 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/kvcache-ai/AgentENV/pull/145
Author: @Park-Jiyeonn
Created: 8/9/2026
Status: ❌ Closed

Base: main ← Head: fix/iptables-net-raw

📝 Commits (1)

9206905 fix(network): support iptables-legacy with CAP_NET_RAW

📊 Changes

12 files changed (+39 additions, -27 deletions)

View changed files

📝 .github/actions/sandbox-ci-setup/action.yml (+2 -2)
📝 crates/linux-cap/src/lib.rs (+1 -0)
📝 docs/src/getting-started/quickstart.md (+1 -1)
📝 docs/src/troubleshooting/common-issues.md (+1 -1)
📝 scripts/install.sh (+4 -4)
📝 scripts/run-with-capabilities.sh (+4 -4)
📝 scripts/tests/verify-capability-runner.sh (+1 -1)
📝 scripts/tests/verify-install-service.sh (+2 -2)
📝 src/privileges.rs (+8 -5)
📝 src/sandbox/network/iptables_util.rs (+5 -1)
📝 src/sandbox/network/manager.rs (+8 -4)
📝 src/sandbox/network/slot.rs (+2 -2)

📄 Description

Summary

iptables-legacy needs CAP_NET_RAW in addition to CAP_NET_ADMIN. Pass it through the runtime and scoped helpers so sandbox networking works on hosts using the legacy backend.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/kvcache-ai/AgentENV/pull/145 **Author:** [@Park-Jiyeonn](https://github.com/Park-Jiyeonn) **Created:** 8/9/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/iptables-net-raw` --- ### 📝 Commits (1) - [`9206905`](https://github.com/kvcache-ai/AgentENV/commit/9206905eb9039372b90976a37d187d5c1e9d01c8) fix(network): support iptables-legacy with CAP_NET_RAW ### 📊 Changes **12 files changed** (+39 additions, -27 deletions) <details> <summary>View changed files</summary> 📝 `.github/actions/sandbox-ci-setup/action.yml` (+2 -2) 📝 `crates/linux-cap/src/lib.rs` (+1 -0) 📝 `docs/src/getting-started/quickstart.md` (+1 -1) 📝 `docs/src/troubleshooting/common-issues.md` (+1 -1) 📝 `scripts/install.sh` (+4 -4) 📝 `scripts/run-with-capabilities.sh` (+4 -4) 📝 `scripts/tests/verify-capability-runner.sh` (+1 -1) 📝 `scripts/tests/verify-install-service.sh` (+2 -2) 📝 `src/privileges.rs` (+8 -5) 📝 `src/sandbox/network/iptables_util.rs` (+5 -1) 📝 `src/sandbox/network/manager.rs` (+8 -4) 📝 `src/sandbox/network/slot.rs` (+2 -2) </details> ### 📄 Description ### Summary iptables-legacy needs CAP_NET_RAW in addition to CAP_NET_ADMIN. Pass it through the runtime and scoped helpers so sandbox networking works on hosts using the legacy backend. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-29 14:21:02 +00:00