S009: Dynamic Rules

Overview

Dynamic rules allow outcalld to insert and remove per-container or per-network nftables rules at runtime, without restarting the daemon or reloading the full ruleset. This is the enforcement mechanism that translates rule engine verdicts (S003) into actual packet filtering decisions at the bridge level (S001).

The base nftables ruleset (S001) blocks everything by default. Dynamic rules punch holes — allowing specific traffic flows for specific containers based on the loaded policy. When a container is stopped or a rule is revoked, the corresponding nftables rules are removed and traffic is blocked again.

User Scenarios

S009-US-001 [P1] As outcalld, I want to insert nftables allow rules when the rule engine grants a verdict, so that approved traffic can flow through the bridge.

S009-US-002 [P1] As outcalld, I want to remove nftables rules when a container is stopped or a rule is revoked, so that traffic is re-blocked immediately.

S009-US-003 [P2] As a host operator, I want to list active dynamic rules so that I can see what traffic is currently allowed.

Requirements Summary

Cross-Spec Dependencies

• Depends on: S001 (nftables base ruleset)
• Depends on: S003 (verdicts trigger rule insertion)
• Required by: S008