test(ec2): real packet-filtering E2E + privileged CI job + image nft smoke

[vieiralucas]

Summary

Closes the two test-coverage gaps the 2026-06-18 bug-hunt surfaced (and that I flagged when you asked about E2E coverage): nothing ever dropped a real packet, and nothing ran the shipped image to confirm the enforcement binary is present.

• ec2_sg_enforcement_real.rs — with enforcement ON (nftables + CAP_NET_ADMIN on a native-Linux Docker host), boots two instances in one subnet under a no-ingress SG and asserts A genuinely cannot ping B; then AuthorizeSecurityGroupIngress(icmp) → ping works; Revoke → dropped again. A real packet drop/allow, not a generated-ruleset assertion. Gated on FAKECLOUD_TEST_SG_ENFORCE=1: hard-fails (never silently skips) when the gate is on but the host can't enforce; skips otherwise.
• e2e.yml — new privileged sg-enforcement job: installs nftables, runs that test as root so the spawned fakecloud holds CAP_NET_ADMIN.
• docker.yml — real artifact smoke: load the just-built image and docker run --entrypoint nft … --version, so a future drop of nft from the image fails the build (the Lambdas on macOS #1539 Bug-4 / finding 0.1 class).
• distribution_dockerfile.rs — cheap PR-gating guard that the Dockerfile installs nftables + the docker CLI (docker.yml only runs post-merge).

Test plan

• The privileged sg-enforcement CI job runs the real packet test end-to-end.
• distribution_dockerfile tests pass (Dockerfile contains nftables).
• Partition coverage check passes (new tests covered). clippy + fmt clean.

---

Summary by cubic

Adds a real EC2 security‑group enforcement E2E proving packets are dropped then allowed via nft, adds a privileged CI job, and smoke‑tests the image to ensure nft ships. Also fixes same‑subnet enforcement and first‑apply ruleset load, and documents container‑IP matching limits and bridge‑netfilter behavior.

• New Features

  • E2E ec2_sg_enforcement_real.rs: two instances under a no‑ingress SG; ping blocked → allowed after ICMP authorize from 0.0.0.0/0 (revoke step removed due to conntrack). Gated by FAKECLOUD_TEST_SG_ENFORCE=1.
  • CI sg-enforcement job: runs as root on Linux, installs nftables, pre‑pulls alpine:3, appends /usr/sbin:/sbin to PATH, builds and runs the test.
  • Image checks: load the built image and run nft --version; guard test asserts the Dockerfile installs nftables and includes the Docker CLI.
  • Docs: call out that enforced SG source matching uses container IPs, and that bridge netfilter is enabled so same‑subnet traffic is filtered.

• Bug Fixes

  • Same‑subnet traffic is now filtered by loading br_netfilter and setting net.bridge.bridge-nf-call-iptables=1.
  • nft ruleset now prepends add table inet fakecloud_ec2 before flush so the first load succeeds; unit test asserts the ordering.

^{Written for commit 4fe4b1e. Summary will update on new commits.}

[codecov]

Codecov Report

❌ Patch coverage is 42.85714% with 8 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/fakecloud-ec2/src/runtime/mod.rs	0.00%	8 Missing ⚠️

📢 Thoughts on this report? Let us know!