fix: refactor to use eBPF over iptables for better routing control

[schmitthub]

Summary

• Rename dockertest → docker/mock: Moves the fake client package and adds mock_moby.go for lightweight moby client.APIClient mocking without whail dependency.
• Firewall test stub: New firewall/mocks.NewTestManager(t, cfg) creates a real Manager backed by a mock moby client for rule store tests.
• eBPF Routing

Test plan

• 6 new tests in priority_test.go verify local-layer rules appear first in TCP mappings
• All 4393 existing tests pass (make test)
• Pre-commit hooks pass (semgrep, golangci-lint, govulncheck, gitleaks)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR aims to ensure the current project’s TCP/SSH firewall rules take priority in iptables ordering (so local SSH access works even when the global/store rules contain overlapping ports), while also renaming the Docker test fake package to internal/docker/mock and introducing a lightweight Moby client mocking utility for tests.

Changes:

• Adjust firewall TCP mapping generation to prepend the most-local project config layer rules before store rules (first-seen-wins dedup → local priority).
• Rename internal/docker/dockertest → internal/docker/mock and update call sites across tests.
• Add firewall testing utilities (firewall/mocks.NewTestManager) plus new tests validating TCP mapping priority behavior.

Reviewed changes

Copilot reviewed 33 out of 33 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/e2e/harness/factory.go	Updates imports/usage to the renamed Docker fake client package.
internal/firewall/priority_test.go	Adds tests asserting local-layer TCP/SSH rule ordering wins over stored rules.
internal/firewall/mocks/stubs.go	Adds a test helper that builds a real firewall.Manager backed by a mocked Moby client.
internal/firewall/manager.go	Changes TCP mapping computation to prioritize local-layer rules; exposes FormatPortMappings and adds local-layer rule extraction helper.
internal/docker/wirebuildkit_test.go	Updates to use the renamed Docker fake client package.
internal/docker/mock/mock_moby.go	Adds an HTTP-transport-based mock helper for Moby client creation/version negotiation.
internal/docker/mock/helpers.go	Renames package to mock.
internal/docker/mock/fake_client.go	Renames package to mock.
internal/docker/mock/fake_client_test.go	Updates tests for the renamed Docker fake client package.
internal/cmd/loop/shared/runner_test.go	Updates imports/types to internal/docker/mock.
internal/cmd/loop/shared/concurrency_test.go	Updates fixtures and fake client usage to internal/docker/mock.
internal/cmd/image/build/build_progress_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/wait/wait_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/update/update_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/unpause/unpause_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/top/top_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/stop/stop_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/stats/stats_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/start/start_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/shared/init_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/run/run_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/restart/restart_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/rename/rename_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/remove/remove_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/pause/pause_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/logs/logs_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/list/list_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/kill/kill_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/inspect/inspect_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/exec/exec_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/create/create_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/cp/cp_test.go	Updates fake Docker client usage to internal/docker/mock.
internal/cmd/container/attach/attach_test.go	Updates fake Docker client usage to internal/docker/mock.

Comments suppressed due to low confidence (3)

internal/docker/mock/fake_client.go:15

• The package-level doc comment still refers to "Package dockertest" and shows usage with dockertest.NewFakeClient / dockertest.RunningContainerFixture, but the package was renamed to internal/docker/mock. Update the comment and examples to use the new package name to avoid confusion for future test authors.
  internal/cmd/container/stop/stop_test.go:306
• The helper function parameter is named mock, which shadows the imported mock package identifier in this scope and makes it harder to read/extend the helper (and can cause accidental compile errors if the package is referenced inside). Rename the parameter to something specific like sbMock / bridgeMock to avoid shadowing.

// --- Per-package test helpers ---

func testFactory(t *testing.T, fake *mock.FakeClient, mock *sockebridgemocks.SocketBridgeManagerMock) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffer, *bytes.Buffer) {
	t.Helper()
	tio, in, out, errOut := iostreams.Test()

	f := &cmdutil.Factory{
		IOStreams: tio,
		Logger:    func() (*logger.Logger, error) { return logger.Nop(), nil },
		Client: func(_ context.Context) (*docker.Client, error) {
			return fake.Client, nil
		},
		Config: func() (config.Config, error) {
			return configmocks.NewBlankConfig(), nil
		},
	}

	if mock != nil {
		f.SocketBridge = func() socketbridge.SocketBridgeManager {
			return mock
		}

internal/cmd/container/remove/remove_test.go:327

• The helper function parameter is named mock, which shadows the imported mock package identifier in this scope and makes the helper harder to read/extend. Rename the parameter (e.g., sbMock / bridgeMock) to avoid identifier shadowing.

// --- Per-package test helpers ---

func testFactory(t *testing.T, fake *mock.FakeClient, mock *sockebridgemocks.SocketBridgeManagerMock) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffer, *bytes.Buffer) {
	t.Helper()
	tio, in, out, errOut := iostreams.Test()

	f := &cmdutil.Factory{
		IOStreams: tio,
		Logger:    func() (*logger.Logger, error) { return logger.Nop(), nil },
		Client: func(_ context.Context) (*docker.Client, error) {
			return fake.Client, nil
		},
		Config: func() (config.Config, error) {
			return configmocks.NewBlankConfig(), nil
		},
	}

	if mock != nil {
		f.SocketBridge = func() socketbridge.SocketBridgeManager {
			return mock
		}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 99 out of 103 changed files in this pull request and generated 7 comments.

Comments suppressed due to low confidence (2)

internal/docker/mocks/fake_client.go:12

• The package doc comment and examples refer to mock (singular) but the actual package name is mocks. This makes godoc misleading and the usage snippet won’t compile as written; update the comment/examples to use mocks.NewFakeClient / mocks.RunningContainerFixture.
  internal/docker/mocks/helpers.go:522
• The example in the SetupBuildKit doc comment uses mock.NewFakeClient, which doesn’t match the package name (mocks). Update the snippet so it compiles and matches other docs (mocks.NewFakeClient).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 102 out of 108 changed files in this pull request and generated 9 comments.

Comments suppressed due to low confidence (2)

internal/docker/mocks/fake_client.go:15

• The package comment/example still refers to mock (e.g., fake := mock.NewFakeClient(cfg)), but the package is mocks. This will confuse users and appears incorrect in generated docs; update the text/examples to use mocks.NewFakeClient and mocks.RunningContainerFixture.
  internal/docker/mocks/helpers.go:522
• The example in this comment uses mock.NewFakeClient(cfg), but the package is mocks. Update the example to mocks.NewFakeClient(cfg) to keep docs accurate.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 116 out of 122 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (2)

internal/docker/mocks/fake_client.go:15

• Package/docs naming mismatch: this file declares package mocks, but the doc comment and examples refer to Package mock and mock.NewFakeClient(...). Update the comment/examples to use mocks so godoc and copy/paste usage are correct.
  internal/docker/mocks/helpers.go:522
• The example in this comment uses mock.NewFakeClient(...), but the package name is mocks (and there is no mock identifier). Update the example so it compiles when copied (e.g., mocks.NewFakeClient(...)).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 124 out of 129 changed files in this pull request and generated 6 comments.

Comments suppressed due to low confidence (2)

internal/docker/mocks/fake_client.go:15

• Package-level doc comment and examples refer to mock.* (package name + constructor), but the actual package is mocks and NewFakeClient requires a config.Config argument. Update the comment/examples so they match the exported API (mocks.NewFakeClient(cfg) / mocks.RunningContainerFixture(...)).
  internal/docker/mocks/helpers.go:523
• This example uses mock.NewFakeClient(cfg), but the package name is mocks (and callers typically use mocks.NewFakeClient(cfg) or just NewFakeClient(cfg) within the package). As written, the example won’t compile if copied.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 124 out of 126 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (2)

internal/docker/mocks/fake_client.go:12

• Package-level doc comment and examples refer to a non-existent mock package (// Package mock ..., mock.NewFakeClient, mock.RunningContainerFixture). The actual package name is mocks, so these examples are misleading and can confuse users/search (and break copy/paste). Update the doc comment and examples to use mocks consistently.
  internal/docker/mocks/helpers.go:522
• The SetupBuildKit usage example uses mock.NewFakeClient(cfg), but the package is internal/docker/mocks and callers should use mocks.NewFakeClient. This example currently won’t compile when copy/pasted.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 125 out of 127 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (2)

internal/docker/mocks/fake_client.go:5

• The package doc comment doesn’t match the actual package name. Go stylecheck (ST1000) expects the comment to start with Package mocks ... (and the usage snippet should reference mocks.NewFakeClient / mocks.RunningContainerFixture). As written (Package mock ...), this is likely to fail lint and is also confusing for readers.
  internal/docker/mocks/helpers.go:521
• The usage example in this comment uses mock.NewFakeClient, but the package is internal/docker/mocks (plural). Update the example to mocks.NewFakeClient so it’s copy/pasteable and consistent with the renamed package.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 127 out of 129 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (3)

internal/docker/mocks/fake_client.go:5

• Package-level GoDoc comment uses the wrong package name ("Package mock") even though the package is named mocks. This can confuse readers and may trip linters that enforce Package <name> prefixes; update it to Package mocks ....
  internal/docker/mocks/fake_client.go:12
• The usage example in the package comment references mock.NewFakeClient / mock.RunningContainerFixture, but the package is mocks. Copy/pasting this example won’t compile; update the snippet to use mocks.*.
  internal/docker/mocks/helpers.go:522
• This GoDoc example uses mock.NewFakeClient(cfg) but the package is mocks. Update the snippet to mocks.NewFakeClient(cfg) so the documentation is copy/paste-correct.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 151 out of 153 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (3)

internal/docker/mocks/fake_client.go:1

• The package doc comment says Package mock but the actual package name is mocks. This is misleading in GoDoc and when searching for the package; update the comment to Package mocks to match the directory/package name.
  internal/docker/mocks/fake_client.go:12
• The usage example references mock.NewFakeClient / mock.RunningContainerFixture, but the package is mocks. Update the example to use mocks.* so copy/paste works.
  internal/docker/mocks/helpers.go:520
• This comment example uses mock.NewFakeClient(cfg) but the package is mocks. Update the example to mocks.NewFakeClient(cfg) to avoid confusion.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.