claude-hdb 3bed7c2f2a fix: isolate boxes with the bridge's port-isolation flag, not an nft rule ... The nft bridge-family rule from the previous commit is LIVE on the host and boxes still reach each other: table bridge claudebox { chain forward { ... meta ibrname "claudenet" meta obrname "claudenet" drop } } FAIL BOX A REACHES BOX B — sibling isolation does NOT hold [tcp: refused] So the rule is not wrong about intent, it is wrong about mechanism — whatever path these frames take, that hook does not stop them. Rather than reason harder about netfilter (reasoning is what put the hole there in the first place), use the mechanism Incus provides for exactly this: security.port_isolation on the bridged NIC, which sets the kernel bridge port's isolated flag so two isolated ports cannot exchange frames at all. The nft rule stays as a second layer — it costs nothing — but the profile flag is what carries the guarantee. doctor.sh checks it, because the absence of this one is invisible: everything works and boxes can simply reach each other. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		2026-07-14 01:41:18 +00:00
..
claude-dev.yaml	fix: isolate boxes with the bridge's port-isolation flag, not an nft rule	2026-07-14 01:41:18 +00:00