Filter traffic by user

An iptables rule with the owner match fails in an AgentBox sandbox because the kernel does not include the xt_owner module. Use the nftables meta skuid or meta skgid expressions instead.

The following example creates an output chain and matches processes running as UID 1000. The rule only counts and accepts their packets; replace its verdict with the filtering behavior your application needs.

import { Sandbox } from "@abox-dev/sdk";

const sandbox = await Sandbox.create();

try {
  await sandbox.commands.run(
    "apt-get update -qq && " +
      "DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nftables",
    { user: "root", timeoutMs: 120_000 },
  );

  const result = await sandbox.commands.run(
    "nft add table inet user_filter && " +
      "nft 'add chain inet user_filter output { type filter hook output priority 0; policy accept; }' && " +
      "nft add rule inet user_filter output meta skuid 1000 counter accept && " +
      "nft list chain inet user_filter output",
    { user: "root" },
  );

  console.log(result.stdout);
} finally {
  await sandbox.kill();
}

Run firewall commands as root. The table exists only inside the sandbox and is removed when the sandbox stops.