control
¶Live nft-mutation verbs — allow, deny, up, down, quarantine, rules, preview.
Each verb mutates or inspects a running container's shield ruleset. The
handlers accept (shield, [container], **kwargs) and print to stdout;
the CLI dispatcher builds the Shield and forwards
the parsed argv.
ALLOW = CommandDef(name='allow', help='Live-allow a domain or IP for a container', handler=_handle_allow, extras=NEEDS_CTR, args=(CONTAINER_ARG, ArgDef(name='target', help='Domain name or IP address to allow')))
module-attribute
¶DENY = CommandDef(name='deny', help='Live-deny a domain or IP for a container', handler=_handle_deny, extras=NEEDS_CTR, args=(CONTAINER_ARG, ArgDef(name='target', help='Domain name or IP address to deny')))
module-attribute
¶DOWN = CommandDef(name='down', help='Switch container to bypass mode (accept-all + log)', handler=_handle_down, extras=NEEDS_CTR, args=(CONTAINER_ARG, CONTAINER_ID_ARG, ArgDef(name='--all', action='store_true', dest='allow_all', help='Also allow private-range traffic')))
module-attribute
¶UP = CommandDef(name='up', help='Restore deny-all mode for a container', handler=_handle_up, extras=NEEDS_CTR, args=(CONTAINER_ARG, CONTAINER_ID_ARG))
module-attribute
¶QUARANTINE = CommandDef(name='quarantine', help='Total network blackout (drop all, log dropped traffic)', handler=_handle_quarantine, extras=NEEDS_CTR, args=(CONTAINER_ARG,))
module-attribute
¶RULES = CommandDef(name='rules', help='Show current nft rules for a container', handler=_handle_rules, extras=NEEDS_CTR, args=(CONTAINER_ARG,))
module-attribute
¶PREVIEW = CommandDef(name='preview', help='Show ruleset that would be applied', handler=_handle_preview, args=(ArgDef(name='--down', action='store_true', help='Show bypass ruleset'), ArgDef(name='--all', action='store_true', dest='allow_all', help='Omit private-range reject rules (requires --down)')))
module-attribute
¶