fix(docker): simplify to localhost+Squid-only iptables - #1270

Merged

Mossaka merged 11 commits into

mainfrom

fix/011-simplify-security-model

Mar 13, 2026

Commits on Mar 13, 2026

fix(security): simplify to localhost+Squid-only iptables

Mossaka
and
claude
committed
d9d01cc
test: add host-iptables coverage for uncovered paths

Mossaka
and
claude
committed
f2962c2
test: add hasRateLimitOptions test to fix function coverage regression

Mossaka
and
claude
committed
3e8a6e4
fix: save and restore Docker DNS DNAT rules across NAT flush

Mossaka
and
claude
committed
0347f02
fix: restore DNS forwarding rules in DOCKER-USER chain

Mossaka
and
claude
committed
9111cb2
test: add unmountSslTmpfs tests to restore function coverage

Mossaka
and
claude
committed
88219b6
fix: add UDP DROP rule to prevent DNS exfiltration

Mossaka
and
claude
committed
9b26c6b
fix(action): use GITHUB_TOKEN for API calls to avoid 403

Mossaka
and
claude
committed
10a5fdc
fix: restore explicit DNS ACCEPT rules for Docker DNS forwarding

Mossaka
and
claude
committed
f4e095e
fix: resolve rebase conflicts with DoH support from main

Mossaka
and
claude
committed
88f4f55
fix: create FW_WRAPPER_V6 chain before adding IPv6 DNS rules

Mossaka
and
claude
committed
2253b07