ADR 0169: the firewall seat serves its verbs, and a foreign rule set is removed through one of them

Designs 33 and 08 revised. The first node-scoped seat with verbs: rules, reload, remove; the nftables module holds it from a runtime with NET_ADMIN, the first container to declare a capability.
2026-10-02 13:27:03 +02:00
parent aa5d9f1045
commit 4567e13071
4 changed files with 105 additions and 1 deletions
@@ -180,6 +180,7 @@ python3 00-META/checks/index.py            fail if stale
 - **0167** — [A membership carries what its module receives, and who the mesh is](0167-a-membership-carries-what-its-module-receives-and-who-the-mesh-is.md)
 - **0168** — [A converged machine is filtered by the mesh alone, and the host says what else refuses](0168-a-converged-machine-is-filtered-by-the-mesh-alone.md)
 - **0169** — [A machine joins through the tunnel, and the bus is never public](0169-a-machine-joins-through-the-tunnel-and-the-bus-is-never-public.md)
+- **0169** — [The firewall seat serves its verbs, and a foreign rule set is removed through one of them](0169-the-firewall-seat-serves-its-verbs.md)

 ### Its tiers, from the bottom up