From ab6e486686bf64bd7a7a936d5aabc13f70587d62 Mon Sep 17 00:00:00 2001
From: didericis <eric@dideric.is>
Date: Thu, 16 Jul 2026 14:22:28 -0400
Subject: [PATCH] fix(firecracker-netpool): make nft table installs
 delete-first idempotent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Each nft table (isolation, orchestrator-egress nat, agent->gateway route)
was re-applied as a plain `table {...}` block, which on a bare `up`
re-apply (not the systemd down->up path) would append duplicate rules or
error on the existing base chains. Use the standard delete-first pattern
(create empty, delete, recreate) so `up` lands identical state regardless
of history — the setup reproduces cleanly on a fresh install and on
re-apply, not just via a full down->up cycle.

No functional change to the resulting ruleset; only its idempotency.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck
---
 scripts/firecracker-netpool.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/scripts/firecracker-netpool.sh b/scripts/firecracker-netpool.sh
index bcf201c..2d2ce7c 100755
--- a/scripts/firecracker-netpool.sh
+++ b/scripts/firecracker-netpool.sh
@@ -163,7 +163,12 @@ _install_nft() {
     #   input: a VM never needs host-local delivery (its gateway is
     #     reached via DNAT->forward), so drop all direct input from VMs
     #     -> host services bound on 0.0.0.0 are unreachable from the VM.
+    # Delete-first (create empty, delete, recreate) so a re-applied `up`
+    # lands identical state instead of appending rules / erroring on the
+    # existing base chains — the setup is idempotent regardless of history.
     nft -f - <<EOF
+table inet $TABLE {}
+delete table inet $TABLE
 table inet $TABLE {
     chain forward {
         type filter hook forward priority -10; policy accept;
@@ -199,6 +204,8 @@ EOF
 #                    (skipped once Docker is gone).
 _install_orch_egress() {
     nft -f - <<EOF
+table inet ${TABLE}_nat {}
+delete table inet ${TABLE}_nat
 table inet ${TABLE}_nat {
     chain forward {
         type filter hook forward priority -10; policy accept;
@@ -240,6 +247,8 @@ _docker_user_orch() {
 # /31 unspoofable) guest IP.
 _install_gateway_route() {
     nft -f - <<EOF
+table ip ${TABLE}_gw {}
+delete table ip ${TABLE}_gw
 table ip ${TABLE}_gw {
     chain prerouting {
         type nat hook prerouting priority -100; policy accept;