feat(supervisor): netlink/syscall network setup so the privileged supervisor needs no workload-image tools

Bắt đầu bằng cách đọc crates/openshell-supervisor-process/src/netns/mod.rs, đặc biệt là các điểm gọi external ip, nsenter, nft và dmesg, đồng thời xem xét các issue liên quan #2750, #2382 và #1335. Tìm hiểu cách tiếp cận được đề xuất với rtnetlink, setns/unshare, nf_tables và NFLOG, sau đó xác minh các tiêu chí nghiệm thu trên Docker, rootless Podman và Kubernetes. Được coi là hoàn tất khi proxy mode khởi động trên một Alpine image chưa sửa đổi mà không cần các công cụ mạng trong workload-image, trong khi các image đã có sẵn các công cụ đó vẫn giữ nguyên hành vi.

User Story

As an OpenShell operator, I want a sandbox to start with the default generic Alpine image in proxy mode without the sandbox image having to ship iproute2/nftables, so that the #3116 Alpine default works on unmodified base images.

Problem Statement

In proxy mode the privileged supervisor sets up the sandbox network namespace by shelling out to tools resolved from the workload image: ip (netns/veth/addr/route — 32 call sites in crates/openshell-supervisor-process/src/netns/mod.rs), nsenter (9), nft (6), and dmesg (bypass monitoring). A bare Alpine image only ships busybox ip (no netns subcommand) and no nftables/iptables, so the supervisor fails at startup with Network namespace creation failed ... iproute2 is installed and the sandbox container exits.

The community base image previously provided these tools; #3116 removes that dependency by defaulting to bare Alpine, which surfaces the gap. Only setns (8 call sites) is already a direct syscall today — namespace/veth/route creation and firewall rules still spawn external binaries.

This is the networking subset of #2750 (make the privileged supervisor independent of workload-image code), scoped down so it can land as a focused change that unblocks #3116.

Impact / Why This Matters

Without this, the #3116 default (bare Alpine) cannot run in proxy mode — the enforced-egress path that Secure Agent Workspace and any default-deny deployment rely on. The current workarounds are to keep shipping iproute2/nftables inside every sandbox image (re-introducing the exact image dependency #3116 removes) or to disable proxy mode (losing egress isolation). Neither is acceptable for a generic default.

Proposed Design

Replace the privileged network setup's external-helper calls with in-process kernel interfaces, so the supervisor is self-contained:

• Namespace + veth + addresses + routes: route netlink (rtnetlink) plus setns/unshare with FD-owned namespaces (removes the /run/netns requirement).
• Enter namespaces: setns directly (already used for the enter path).
• Firewall / bypass rules: nf_tables netlink instead of the nft binary.
• Bypass monitoring: NFLOG instead of dmesg (also drops the CAP_SYSLOG requirement; see #2382).

The supervisor binary stays musl-static so it carries no dynamic loader or NSS dependency on the workload image. Behavior on base images that already ship iproute2/nftables must be unchanged.

Acceptance Criteria

• A sandbox created from an unmodified docker.io/library/alpine:* image starts in proxy mode with no ip/nsenter/nft/dmesg executed from the workload image.
• Network namespace, veth, addressing, and routing are created without spawning ip/nsenter.
• Bypass-detection firewall rules are programmed without the nft binary.
• Bypass monitoring works without dmesg / CAP_SYSLOG.
• Verified on the Docker, rootless Podman, and Kubernetes runtimes.
• No behavior change for base images that already ship the tools.

Alternatives Considered

• Mount the tools from a trusted OpenShell image into the sandbox (Phase 1 of #2750): works, but drags dynamic libraries across libc boundaries (glibc tools on musl Alpine) and remains a mount/compatibility burden; the netlink approach removes the dependency entirely.
• Require the default image to bundle iproute2/nftables: re-introduces the image dependency #3116 removes and bloats the generic default.

Scope

In: the networking subset above.

Out (remains in #2750): the Phase 3 execution boundary (deny execve after startup, unprivileged workload/SSH execution), the Podman health-check and Kubernetes PVC-seeding shells, the hostile-image test suite, and the VM guest path.

Related

• Sub-task of #2750
• Unblocks #3116 (proxy-mode networking on a bare Alpine default)
• Related: #2382 (NFLOG bypass detection), #1335 (nftables migration)