RFC: optional eBPF (bpf_sk_assign) egress steering as an alternative to per-slot iptables REDIRECT

Problem

Egress TCP is steered to the firewall proxy via per-slot nat PREROUTING ... -j REDIRECT --to-ports (3 rules/slot, in the shared nat table). Issues:

• The nat table is shared host state. Co-tenant software (e.g. Docker) reconciling iptables can reorder or drop these rules, intermittently breaking egress.
• Original-destination recovery depends on conntrack/DNAT via SO_ORIGINAL_DST.
• Rule count scales 3×N with sandboxes.

Proposal

Optional, feature-flagged tc/eBPF steering. Default off; iptables REDIRECT stays the default.

• tc (tcx) eBPF program on each sandbox veth classifies egress TCP by original dst port and bpf_sk_assigns it to the existing firewall listener; marks the skb so policy routing delivers it locally. No DNAT, no per-slot nat rules.
• Listeners run IP_TRANSPARENT; original dst recovered from LocalAddr().
• Wired through the existing network.EgressProxy seam (OnSlotCreate/OnSlotDelete).

Benefits

• Per-interface, orchestrator-owned (tcx) — immune to co-tenant nat churn.
• Zero per-slot nat rules (one-time host setup instead of 3×N).
• Original dst from the kernel socket, not conntrack.
• Clean teardown (detach a link vs. delete rules).

Requirements

• Kernel: tcx (≥5.16) + bpf_sk_assign (≥5.7) + BTF/CO-RE. Flag gates on support; REDIRECT is the fallback.
• One-time host setup: ip rule add fwmark 1 lookup 100, a local default route in table 100, and an INPUT allow for mark 1.

Status

Implemented and validated end-to-end: a real sandbox reaches the internet through eBPF steering → transparent proxy → upstream, original dst recovered, zero per-slot REDIRECT rules. PR-ready.

Questions

1. Interest in an optional eBPF egress path, or is REDIRECT intentionally the only mechanism?
2. Preferred gating (env flag vs. feature-flags client) and target kernel floor?
3. Host local-delivery setup (ip rule + table): orchestrator-managed at startup, or a documented prerequisite?

Start by reading the existing network.EgressProxy seam, especially OnSlotCreate and OnSlotDelete, and review how the current per-slot iptables REDIRECT path is wired. Confirm the proposed tc/eBPF path can be feature-gated with REDIRECT as fallback, supports the stated kernel requirements, and performs clean setup and teardown; the remaining questions require maintainer decisions.