#!/bin/sh
# Runs a command on Linux in a network namespace made for it, as the
# calling user with CAP_NET_ADMIN and nothing else: what the tests that
# change a kernel's routes need. For running one of them by hand, e.g.
#
#   FERRIX_ROUTES=1000000 scripts/in-namespace.sh cargo test --release \
#       -p bgp-fib --test kernel many -- --include-ignored --nocapture
set -eu
namespace="ferrix-ns-$$"
sudo modprobe dummy 2>/dev/null || true
sudo ip netns add "$namespace"
trap 'sudo ip netns del "$namespace"' EXIT
sudo ip netns exec "$namespace" ip link set lo up
sudo ip netns exec "$namespace" \
    setpriv --reuid "$(id -u)" --regid "$(id -g)" --init-groups \
    --inh-caps +net_admin --ambient-caps +net_admin \
    env PATH="$PATH" HOME="$HOME" CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-}" \
    FERRIX_ROUTES="${FERRIX_ROUTES:-}" "$@"