Add iptables to http-proxy docker images

[AGMETEOR]

No description provided.

[Copilot]

Pull Request Overview

This PR adds an iptables-based masquerading setup to the http-proxy container, driven by environment variables.

• Install and enable iptables in the Docker runtime image
• Introduce servermasq.sh to configure a custom NAT chain at container start
• Update Dockerfile to run servermasq.sh as the entrypoint before launching the proxy

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
servermasq.sh	New startup script that creates/flushes a LANTERN_SERVERMASQ chain and applies DNAT rules based on $PROXY_ADDR, $PROXY_PORT, and $MASQ_ADDR
Dockerfile	Installs iptables, copies and marks servermasq.sh executable, and sets it as the container entrypoint prior to running the proxy

Comments suppressed due to low confidence (1)

servermasq.sh:1

• [nitpick] Add a header comment describing the purpose of this script and its required environment variables (PROXY_ADDR, PROXY_PORT, MASQ_ADDR) to improve maintainability.

#!/bin/sh

[Copilot]

The servermasq.sh entrypoint executes iptables commands, which require root privileges, but the container switches to the unprivileged lantern user before running the script. Consider moving USER lantern below the entrypoint or running the iptables setup as root and then dropping privileges before starting the proxy.

Suggested change

	USER lantern
	ENTRYPOINT ["/servermasq.sh"]
	ENTRYPOINT ["/servermasq.sh"]
	USER lantern

[Crosse]

I'm good with this, but I do think we need to test it on a single track first before rolling it out fleet-wide.

[Crosse]

Suggested change

	# The iptables rules can be expalined as follows:
	# The iptables rules can be explained as follows: