fix(security): add iptables to Dockerfile for network policy enforcement

[ericksoa]

Summary

• Add pinned iptables=1.8.9-2 to the Dockerfile apt-get install block
• Add regression test (test 10) to e2e-gateway-isolation.sh verifying iptables is present

Without iptables, OpenShell logs iptables not found; bypass detection rules will not be installed and all sandbox network policies report Active: 0. Every outbound connection succeeds regardless of the configured policy, rendering openclaw-sandbox.yaml and all presets ineffective.

PR #721 addressed gateway process isolation but did not add the missing iptables package. This PR closes that gap.

Test plan

• docker build succeeds with the new package
• docker run --rm --entrypoint "" <image> iptables --version prints iptables v1.8.9
• bash test/e2e-gateway-isolation.sh — all 11 tests pass (new test 10 verifies iptables)
• Deploy sandbox and verify openshell policy status shows Active: >0 rules

Summary by CodeRabbit

• Chores

  • Updated the container runtime to include a pinned iptables package to support network policy enforcement and improve isolation.

• Tests

  • Gateway isolation tests now verify iptables is installed (root check) and retain a separate sandbox-user permission test that confirms unauthorized process termination is prevented.

[coderabbitai]

📝 Walkthrough

Walkthrough

Dockerfile now pins and installs iptables=1.8.9-2 in the runtime image. The end-to-end gateway isolation test script changes Test 10 to verify iptables --version as root and adds Test 11 to perform the sandbox user's gateway-kill permission check previously in Test 10.

Changes

Cohort / File(s)	Summary
Runtime image and gateway isolation tests Dockerfile, test/e2e-gateway-isolation.sh	Dockerfile: add pinned iptables=1.8.9-2 to runtime apt installs. Tests: Test 10 now checks iptables --version as root; new Test 11 restores the sandbox user's gateway-kill permission check (previously Test 10).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 I hopped into Docker with a keen little pat,
Pinned iptables snug in the image's hat,
Tests now ask "who runs the rules today?"
A sleepy gateway sleeps while sandboxes say nay,
Hooray for packets that safely stay on track! 🎩🐇

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and concisely summarizes the main change: adding iptables to the Dockerfile for network policy enforcement, which is the primary purpose of this PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/add-iptables-to-dockerfile-v2

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}