[ { "Id": "4e7c3daeba15546e7640014b9ee46e389737ed36583e5cb2f8b75a07a82e8523", "Created": "2025-01-24T13:54:02.258266254Z", "Path": "/usr/bin/tini", "Args": [ "--", "/usr/sbin/nft-helper", "/etc/nftables.conf" ], "State": { "OciVersion": "1.1.0-rc.1", "Status": "running", "Running": true, "Paused": false, "Restarting": false, "OOMKilled": false, "Dead": false, "Pid": 6693, "ConmonPid": 6688, "ExitCode": 0, "Error": "", "StartedAt": "2025-01-24T13:54:02.738587091Z", "FinishedAt": "0001-01-01T00:00:00Z", "Health": { "Status": "", "FailingStreak": 0, "Log": null }, "CgroupPath": "/containers/libpod-4e7c3daeba15546e7640014b9ee46e389737ed36583e5cb2f8b75a07a82e8523", "CheckpointedAt": "0001-01-01T00:00:00Z", "RestoredAt": "0001-01-01T00:00:00Z" }, "Image": "7a3cc502436250357a6664100a600f306334b4d7203890b85b7ea9b8da6b5665", "ImageDigest": "sha256:269ef1857e6bb63f20a70a827a7afddd620eac94d5c7ec11618121b9e271f758", "ImageName": "localhost/curios-nftables-oci-amd64-v24.11.0:latest", "Rootfs": "", "Pod": "", "ResolvConfPath": "/run/containers/storage/overlay-containers/4e7c3daeba15546e7640014b9ee46e389737ed36583e5cb2f8b75a07a82e8523/userdata/resolv.conf", "HostnamePath": "/run/containers/storage/overlay-containers/4e7c3daeba15546e7640014b9ee46e389737ed36583e5cb2f8b75a07a82e8523/userdata/hostname", "HostsPath": "/run/containers/storage/overlay-containers/4e7c3daeba15546e7640014b9ee46e389737ed36583e5cb2f8b75a07a82e8523/userdata/hosts", "StaticDir": "/var/lib/containers/storage/overlay-containers/4e7c3daeba15546e7640014b9ee46e389737ed36583e5cb2f8b75a07a82e8523/userdata", "OCIConfigPath": "/var/lib/containers/storage/overlay-containers/4e7c3daeba15546e7640014b9ee46e389737ed36583e5cb2f8b75a07a82e8523/userdata/config.json", "OCIRuntime": "crun", "ConmonPidFile": "/run/container:firewall.pid", "PidFile": "/run/containers/storage/overlay-containers/4e7c3daeba15546e7640014b9ee46e389737ed36583e5cb2f8b75a07a82e8523/userdata/pidfile", "Name": "firewall", "RestartCount": 0, "Driver": "overlay", "MountLabel": "", "ProcessLabel": "", "AppArmorProfile": "", "EffectiveCaps": [ "CAP_AUDIT_CONTROL", "CAP_AUDIT_READ", "CAP_AUDIT_WRITE", "CAP_BLOCK_SUSPEND", "CAP_BPF", "CAP_CHECKPOINT_RESTORE", "CAP_CHOWN", "CAP_DAC_OVERRIDE", "CAP_DAC_READ_SEARCH", "CAP_FOWNER", "CAP_FSETID", "CAP_IPC_LOCK", "CAP_IPC_OWNER", "CAP_KILL", "CAP_LEASE", "CAP_LINUX_IMMUTABLE", "CAP_MAC_ADMIN", "CAP_MAC_OVERRIDE", "CAP_MKNOD", "CAP_NET_ADMIN", "CAP_NET_BIND_SERVICE", "CAP_NET_BROADCAST", "CAP_NET_RAW", "CAP_PERFMON", "CAP_SETFCAP", "CAP_SETGID", "CAP_SETPCAP", "CAP_SETUID", "CAP_SYSLOG", "CAP_SYS_ADMIN", "CAP_SYS_BOOT", "CAP_SYS_CHROOT", "CAP_SYS_MODULE", "CAP_SYS_NICE", "CAP_SYS_PACCT", "CAP_SYS_PTRACE", "CAP_SYS_RAWIO", "CAP_SYS_RESOURCE", "CAP_SYS_TIME", "CAP_SYS_TTY_CONFIG", "CAP_WAKE_ALARM" ], "BoundingCaps": [ "CAP_AUDIT_CONTROL", "CAP_AUDIT_READ", "CAP_AUDIT_WRITE", "CAP_BLOCK_SUSPEND", "CAP_BPF", "CAP_CHECKPOINT_RESTORE", "CAP_CHOWN", "CAP_DAC_OVERRIDE", "CAP_DAC_READ_SEARCH", "CAP_FOWNER", "CAP_FSETID", "CAP_IPC_LOCK", "CAP_IPC_OWNER", "CAP_KILL", "CAP_LEASE", "CAP_LINUX_IMMUTABLE", "CAP_MAC_ADMIN", "CAP_MAC_OVERRIDE", "CAP_MKNOD", "CAP_NET_ADMIN", "CAP_NET_BIND_SERVICE", "CAP_NET_BROADCAST", "CAP_NET_RAW", "CAP_PERFMON", "CAP_SETFCAP", "CAP_SETGID", "CAP_SETPCAP", "CAP_SETUID", "CAP_SYSLOG", "CAP_SYS_ADMIN", "CAP_SYS_BOOT", "CAP_SYS_CHROOT", "CAP_SYS_MODULE", "CAP_SYS_NICE", "CAP_SYS_PACCT", "CAP_SYS_PTRACE", "CAP_SYS_RAWIO", "CAP_SYS_RESOURCE", "CAP_SYS_TIME", "CAP_SYS_TTY_CONFIG", "CAP_WAKE_ALARM" ], "ExecIDs": [], "GraphDriver": { "Name": "overlay", "Data": { "LowerDir": "/var/lib/containers/storage/overlay/5a47f694a11e7abd644d015c96ebe954f5d3099459c7c8dc847b2d8809895f0e/diff", "MergedDir": "/var/lib/containers/storage/overlay/e875e4b43435a968254a293e67ba5ddce3d6a3a889cd8eefa8a5cbf9bf2b857d/merged", "UpperDir": "/var/lib/containers/storage/overlay/e875e4b43435a968254a293e67ba5ddce3d6a3a889cd8eefa8a5cbf9bf2b857d/diff", "WorkDir": "/var/lib/containers/storage/overlay/e875e4b43435a968254a293e67ba5ddce3d6a3a889cd8eefa8a5cbf9bf2b857d/work" } }, "Mounts": [ { "Type": "bind", "Source": "/run/containers/files/firewall-nftables.conf", "Destination": "/etc/nftables.conf", "Driver": "", "Mode": "", "Options": [ "nosuid", "nodev", "rbind" ], "RW": false, "Propagation": "rprivate" } ], "Dependencies": [], "NetworkSettings": { "EndpointID": "", "Gateway": "", "IPAddress": "", "IPPrefixLen": 0, "IPv6Gateway": "", "GlobalIPv6Address": "", "GlobalIPv6PrefixLen": 0, "MacAddress": "", "Bridge": "", "SandboxID": "", "HairpinMode": false, "LinkLocalIPv6Address": "", "LinkLocalIPv6PrefixLen": 0, "Ports": {}, "SandboxKey": "", "Networks": { "host": { "EndpointID": "", "Gateway": "", "IPAddress": "", "IPPrefixLen": 0, "IPv6Gateway": "", "GlobalIPv6Address": "", "GlobalIPv6PrefixLen": 0, "MacAddress": "", "NetworkID": "host", "DriverOpts": null, "IPAMConfig": null, "Links": null } } }, "Namespace": "", "IsInfra": false, "IsService": false, "Config": { "Hostname": "R1", "Domainname": "", "User": "0", "AttachStdin": false, "AttachStdout": false, "AttachStderr": false, "Tty": false, "OpenStdin": false, "StdinOnce": false, "Env": [ "container=podman", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "TERM=xterm", "HOME=/root", "HOSTNAME=R1" ], "Cmd": [ "/usr/sbin/nft-helper", "/etc/nftables.conf" ], "Image": "localhost/curios-nftables-oci-amd64-v24.11.0:latest", "Volumes": null, "WorkingDir": "/", "Entrypoint": "/usr/bin/tini --", "OnBuild": null, "Labels": { "org.opencontainers.image.title": "curiOS-nftables", "org.opencontainers.image.url": "https://github.com/kernelkit/curiOS" }, "Annotations": { "io.container.manager": "libpod", "io.podman.annotations.privileged": "TRUE", "org.opencontainers.image.stopSignal": "15" }, "StopSignal": 15, "HealthcheckOnFailureAction": "none", "CreateCommand": [ "podman", "create", "--name", "firewall", "--conmon-pidfile=/run/container:firewall.pid", "--read-only", "--replace", "--quiet", "--cgroup-parent=containers", "--restart=always", "--systemd=false", "--tz=local", "--privileged=true", "--mount=type=bind,src=/run/containers/files/firewall-nftables.conf,dst=/etc/nftables.conf,readonly=true", "--log-driver", "syslog", "--net=host", "curios-nftables-oci-amd64-v24.11.0" ], "Timezone": "local", "Umask": "0022", "Timeout": 0, "StopTimeout": 10, "Passwd": true, "sdNotifyMode": "container" }, "HostConfig": { "Binds": [ "/run/containers/files/firewall-nftables.conf:/etc/nftables.conf:ro,rprivate,nosuid,nodev,rbind" ], "CgroupManager": "cgroupfs", "CgroupMode": "private", "ContainerIDFile": "", "LogConfig": { "Type": "syslog", "Config": null, "Path": "", "Tag": "", "Size": "0B" }, "NetworkMode": "host", "PortBindings": {}, "RestartPolicy": { "Name": "always", "MaximumRetryCount": 0 }, "AutoRemove": false, "VolumeDriver": "", "VolumesFrom": null, "CapAdd": [], "CapDrop": [], "Dns": [], "DnsOptions": [], "DnsSearch": [], "ExtraHosts": [], "GroupAdd": [], "IpcMode": "shareable", "Cgroup": "", "Cgroups": "default", "Links": null, "OomScoreAdj": 0, "PidMode": "private", "Privileged": true, "PublishAllPorts": false, "ReadonlyRootfs": true, "SecurityOpt": [], "Tmpfs": {}, "UTSMode": "private", "UsernsMode": "", "ShmSize": 65536000, "Runtime": "oci", "ConsoleSize": [ 0, 0 ], "Isolation": "", "CpuShares": 0, "Memory": 0, "NanoCpus": 0, "CgroupParent": "containers", "BlkioWeight": 0, "BlkioWeightDevice": null, "BlkioDeviceReadBps": null, "BlkioDeviceWriteBps": null, "BlkioDeviceReadIOps": null, "BlkioDeviceWriteIOps": null, "CpuPeriod": 0, "CpuQuota": 0, "CpuRealtimePeriod": 0, "CpuRealtimeRuntime": 0, "CpusetCpus": "", "CpusetMems": "", "Devices": [], "DiskQuota": 0, "KernelMemory": 0, "MemoryReservation": 0, "MemorySwap": 0, "MemorySwappiness": 0, "OomKillDisable": false, "PidsLimit": 2048, "Ulimits": [ { "Name": "RLIMIT_NOFILE", "Soft": 1048576, "Hard": 1048576 }, { "Name": "RLIMIT_NPROC", "Soft": 32768, "Hard": 32768 } ], "CpuCount": 0, "CpuPercent": 0, "IOMaximumIOps": 0, "IOMaximumBandwidth": 0, "CgroupConf": null } } ]