### Build and Install slirp4netns

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Steps to install dependencies, compile the source code, and verify the installation.

```bash
# Install build dependencies (Debian/Ubuntu)
sudo apt-get install libglib2.0-dev libslirp-dev libcap-dev libseccomp-dev

# Install build dependencies (Fedora/RHEL)
sudo dnf install glib2-devel libslirp-devel libcap-devel libseccomp-devel

# Build and install
./autogen.sh
./configure --prefix=/usr
make
sudo make install

# Build static binary (optional)
./configure --prefix=/usr LDFLAGS=-static
make

# Verify installation
slirp4netns --version
# slirp4netns version 1.3.3+dev
# commit: abc123...
# libslirp: 4.7.0
# SLIRP_CONFIG_VERSION_MAX: 3
# libseccomp: 2.5.4
```

--------------------------------

### Install Build Dependencies (Debian/Ubuntu)

Source: https://github.com/rootless-containers/slirp4netns/blob/master/README.md

Installs the required development libraries for building slirp4netns on Debian-based systems using apt-get.

```bash
sudo apt-get install libglib2.0-dev libslirp-dev libcap-dev libseccomp-dev
```

--------------------------------

### Install slirp4netns using apt

Source: https://github.com/rootless-containers/slirp4netns/blob/master/README.md

Use this command to install slirp4netns on Debian-based systems.

```bash
$ sudo apt-get install slirp4netns
```

--------------------------------

### Build and Install slirp4netns

Source: https://github.com/rootless-containers/slirp4netns/blob/master/README.md

Executes the standard build process for slirp4netns from source. Ensure libslirp version 4.1.0 or later is installed.

```bash
./autogen.sh
./configure --prefix=/usr
make
sudo make install
```

--------------------------------

### Install Build Dependencies (Fedora/CentOS)

Source: https://github.com/rootless-containers/slirp4netns/blob/master/README.md

Installs the required development libraries for building slirp4netns on Fedora or CentOS systems using dnf.

```bash
sudo dnf install glib2-devel libslirp-devel libcap-devel libseccomp-devel
```

--------------------------------

### Basic Internet Connectivity Setup

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Connects a process's network namespace to the Internet by creating a TAP device and configuring slirp4netns. Requires separate terminals for namespace creation and slirp4netns execution. Ensure DNS is configured and test connectivity.

```bash
# Terminal 1: Create user/network/mount namespaces
unshare --user --map-root-user --net --mount
echo $$ > /tmp/pid

# Terminal 2: Start slirp4netns with automatic configuration
slirp4netns --configure --mtu=65520 $(cat /tmp/pid) tap0

# Expected output:
# Starting slirp
# * MTU:             65520
# * Network:         10.0.2.0
# * Netmask:         255.255.255.0
# * Gateway:         10.0.2.2
# * DNS:             10.0.2.3
# * DHCP begin:      10.0.2.15
# * DHCP end:        10.0.2.30
# * Recommended IP:  10.0.2.100

# Terminal 1: Verify network configuration and test connectivity
ip addr show tap0
# 3: tap0: <BROADCAST,UP,LOWER_UP> mtu 65520 qdisc fq_codel state UNKNOWN
#     link/ether c2:28:0c:0e:29:06 brd ff:ff:ff:ff:ff:ff
#     inet 10.0.2.100/24 brd 10.0.2.255 scope global tap0

# Configure DNS and test Internet access
echo "nameserver 10.0.2.3" > /tmp/resolv.conf
mount --bind /tmp/resolv.conf /etc/resolv.conf
curl https://example.com
```

--------------------------------

### Start slirp4netns

Source: https://github.com/rootless-containers/slirp4netns/blob/master/README.md

Starts the slirp4netns process, configuring a TAP interface named 'tap0' with a specified MTU and disabling host loopback.

```bash
(host)$ slirp4netns --configure --mtu=65520 --disable-host-loopback $(cat /tmp/pid) tap0
```

--------------------------------

### Start slirp4netns API Socket

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Initialize the slirp4netns API server on a specified UNIX socket.

```console
(host)$ slirp4netns --api-socket /tmp/slirp4netns.sock ...
```

--------------------------------

### Start slirp4netns

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Launches the slirp4netns process to provide network connectivity to the namespace.

```console
(host)$ slirp4netns --configure --mtu=65520 $(cat /tmp/pid) tap0
starting slirp, MTU=65520
...
```

--------------------------------

### User Data Persistence Example

Source: https://github.com/rootless-containers/slirp4netns/blob/master/vendor/parson/README.md

Saves and loads user data from 'user_data.json'. If the file is missing or invalid, it prompts the user for their name and creates the file.

```c
void persistence_example(void) {
    JSON_Value *schema = json_parse_string("{\"name\":\"\"}");
    JSON_Value *user_data = json_parse_file("user_data.json");
    char buf[256];
    const char *name = NULL;
    if (user_data == NULL || json_validate(schema, user_data) != JSONSuccess) {
        puts("Enter your name:");
        scanf("%s", buf);
        user_data = json_value_init_object();
        json_object_set_string(json_object(user_data), "name", buf);
        json_serialize_to_file(user_data, "user_data.json");
    }
    name = json_object_get_string(json_object(user_data), "name");
    printf("Hello, %s.", name);
    json_value_free(schema);
    json_value_free(user_data);
    return;
}

```

--------------------------------

### JSON Serialization Example

Source: https://github.com/rootless-containers/slirp4netns/blob/master/vendor/parson/README.md

Creates a JSON object with nested structures and pretty-prints it to the console. Object hierarchy is automatically created using dot notation.

```c
void serialization_example(void) {
    JSON_Value *root_value = json_value_init_object();
    JSON_Object *root_object = json_value_get_object(root_value);
    char *serialized_string = NULL;
    json_object_set_string(root_object, "name", "John Smith");
    json_object_set_number(root_object, "age", 25);
    json_object_dotset_string(root_object, "address.city", "Cupertino");
    json_object_dotset_value(root_object, "contact.emails", json_parse_string("[\"email@example.com\",\"email2@example.com\"]"));
    serialized_string = json_serialize_to_string_pretty(root_value);
    puts(serialized_string);
    json_free_serialized_string(serialized_string);
    json_value_free(root_value);
}

```

--------------------------------

### Start slirp4netns for BESS Mode

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Initiates slirp4netns as a BESS-compatible server to enable network connectivity for User Mode Linux. This command should be run in a separate terminal.

```console
(host)$ slirp4netns --target-type=bess /tmp/bess.sock
```

--------------------------------

### Enable the API Socket

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Start slirp4netns with a Unix socket to enable runtime management of port forwarding.

```bash
slirp4netns --configure --api-socket /tmp/slirp4netns.sock $(cat /tmp/pid) tap0
```

--------------------------------

### Check slirp4netns version and dependencies

Source: https://github.com/rootless-containers/slirp4netns/blob/master/README.md

Displays the installed version of slirp4netns along with the linked libslirp version and other build configurations.

```console
$ slirp4netns --version
slirp4netns version 1.1.8
commit: d361001f495417b880f20329121e3aa431a8f90f
libslirp: 4.4.0
SLIRP_CONFIG_VERSION_MAX: 3
libseccomp: 2.4.3
```

--------------------------------

### Handle API Errors

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Examples of structured JSON error responses returned by the API for invalid requests.

```bash
# Invalid JSON
echo 'not json' | nc -U /tmp/slirp4netns.sock

# Missing execute field
echo '{"foo": "bar"}' | nc -U /tmp/slirp4netns.sock

# Unknown command
echo '{"execute": "unknown_command"}' | nc -U /tmp/slirp4netns.sock

# Invalid protocol
echo '{"execute": "add_hostfwd", "arguments": {"proto": "invalid", "host_port": 80, "guest_port": 80}}' | nc -U /tmp/slirp4netns.sock
```

--------------------------------

### Configure User Mode Linux with BESS

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Starts User Mode Linux and configures its network interface (vec0) to use the BESS socket transport provided by slirp4netns. This involves setting the IP address, bringing the interface up, and configuring the default route.

```console
(host)$ linux.uml vec0:transport=bess,dst=/tmp/bess.sock,depth=128,gro=1 root=/dev/root rootfstype=hostfs init=/bin/bash mem=2G
(UML)$ ip addr add 10.0.2.100/24 dev vec0
(UML)$ ip link set vec0 up
(UML)$ ip route add default via 10.0.2.2
```

--------------------------------

### Parse GitHub Commits Info

Source: https://github.com/rootless-containers/slirp4netns/blob/master/vendor/parson/README.md

Fetches and parses commit information from a GitHub repository using the GitHub API and saves it to 'commits.json'. Requires curl to be installed.

```c
void print_commits_info(const char *username, const char *repo) {
    JSON_Value *root_value;
    JSON_Array *commits;
    JSON_Object *commit;
    size_t i;
    
    char curl_command[512];
    char cleanup_command[256];
    char output_filename[] = "commits.json";
    
    /* it ain't pretty, but it's not a libcurl tutorial */
    sprintf(curl_command, 
        "curl -s \"https://api.github.com/repos/%s/%s/commits\" > %s",
        username, repo, output_filename);
    sprintf(cleanup_command, "rm -f %s", output_filename);
    system(curl_command);
    
    /* parsing json and validating output */
    root_value = json_parse_file(output_filename);
    if (json_value_get_type(root_value) != JSONArray) {
        system(cleanup_command);
        return;
    }
    
    /* getting array from root value and printing commit info */
    commits = json_value_get_array(root_value);
    printf("% -10.10s % -10.10s %s\n", "Date", "SHA", "Author");
    for (i = 0; i < json_array_get_count(commits); i++) {
        commit = json_array_get_object(commits, i);
        printf("%.10s %.10s %s\n",
               json_object_dotget_string(commit, "commit.author.date"),
               json_object_get_string(commit, "sha"),
               json_object_dotget_string(commit, "commit.author.name"));
    }
    
    /* cleanup code */
    json_value_free(root_value);
    system(cleanup_command);
}

```

--------------------------------

### Simplify DNS configuration with rootlesskit

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Uses rootlesskit to automate the /etc filesystem copy-up process.

```console
(host)$ rootlesskit --net=slirp4netns --copy-up=/etc bash
(namespace)$ cat /etc/resolv.conf
nameserver 10.0.2.3
```

--------------------------------

### Configure Network Namespaces

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Commands to set up network interfaces and IP addresses within specific namespaces for connectivity testing.

```bash
# Configure namespace 'foo'
ip netns exec foo ip link set veth-foo name eth0
ip netns exec foo ip link set lo up
ip netns exec foo ip link set eth0 up
ip netns exec foo ip addr add 192.168.42.100/24 dev eth0

# Configure namespace 'bar'
ip netns exec bar ip link set veth-bar name eth0
ip netns exec bar ip link set lo up
ip netns exec bar ip link set eth0 up
ip netns exec bar ip addr add 192.168.42.101/24 dev eth0

# Test connectivity
ip netns exec bar ping 192.168.42.100
```

--------------------------------

### Configure and verify tap0 interface

Source: https://github.com/rootless-containers/slirp4netns/blob/master/README.md

Configures the 'tap0' interface within the namespace, sets up DNS resolution, and tests internet connectivity using curl.

```bash
(namespace)$ ip a
(namespace)$ echo "nameserver 10.0.2.3" > /tmp/resolv.conf
(namespace)$ mount --bind /tmp/resolv.conf /etc/resolv.conf
(namespace)$ curl https://example.com
```

--------------------------------

### Configure Namespace Paths

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Define network and user namespace paths for slirp4netns instances.

```console
(host)$ slirp4netns --netns-type=path ... /path/to/netns tap0
```

```console
(host)$ slirp4netns --netns-type=path --userns-path=/path/to/userns /path/to/netns tap0
```

--------------------------------

### Configure system for unprivileged namespaces

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Required on some distributions if unshare fails due to restricted user namespace permissions.

```console
(host)$ sudo sh -c 'echo "user.max_user_namespaces=28633" >> /etc/sysctl.d/userns.conf'
(host)$ if [ -f /proc/sys/kernel/unprivileged_userns_clone ]; then sudo sh -c 'echo "kernel.unprivileged_userns_clone=1" >> /etc/sysctl.d/userns.conf'; fi
(host)$ sudo sysctl --system
```

--------------------------------

### Create user/network/mount namespaces

Source: https://github.com/rootless-containers/slirp4netns/blob/master/README.md

This command creates the necessary namespaces for running slirp4netns. It maps the current user to root within the new namespaces.

```bash
(host)$ unshare --user --map-root-user --net --mount
(namespace)$ echo $$ > /tmp/pid
```

--------------------------------

### Configure tap0 and DNS resolution

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Verifies network interface configuration and sets up DNS resolution within the namespace.

```console
(namespace)$ ip a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
3: tap0: <BROADCAST,UP,LOWER_UP> mtu 65520 qdisc fq_codel state UNKNOWN group default qlen 1000
    link/ether c2:28:0c:0e:29:06 brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.100/24 brd 10.0.2.255 scope global tap0
       valid_lft forever preferred_lft forever
    inet6 fe80::c028:cff:fe0e:2906/64 scope link 
       valid_lft forever preferred_lft forever
(namespace)$ echo "nameserver 10.0.2.3" > /tmp/resolv.conf
(namespace)$ mount --bind /tmp/resolv.conf /etc/resolv.conf
(namespace)$ curl https://example.com
```

--------------------------------

### Mount filesystem for stable DNS resolution

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Alternative method for handling /etc/resolv.conf when the host uses dynamic management tools.

```console
(namespace)$ mkdir /tmp/a /tmp/b
(namespace)$ mount --rbind /etc /tmp/a
(namespace)$ mount --rbind /tmp/b /etc
(namespace)$ mkdir /etc/.ro
(namespace)$ mount --move /tmp/a /etc/.ro
(namespace)$ cd /etc
(namespace)$ for f in .ro/*; do ln -s $f $(basename $f); done
(namespace)$ rm resolv.conf
(namespace)$ echo "nameserver 10.0.2.3" > resolv.conf
(namespace)$ curl https://example.com
```

--------------------------------

### Connect to User Mode Linux in BESS Mode

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Configure slirp4netns as a BESS server to provide network connectivity to User Mode Linux instances.

```bash
# Terminal 1: Start slirp4netns in BESS mode
slirp4netns --target-type=bess /tmp/bess.sock

# Terminal 2: Start User Mode Linux with BESS transport
linux.uml vec0:transport=bess,dst=/tmp/bess.sock,depth=128,gro=1 \
    root=/dev/root rootfstype=hostfs init=/bin/bash mem=2G

# Inside UML: Configure networking
ip addr add 10.0.2.100/24 dev vec0
ip link set vec0 up
ip route add default via 10.0.2.2
```

--------------------------------

### Synchronization with Ready and Exit File Descriptors

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Utilizes file descriptors for synchronization and graceful termination in scripted environments. The --ready-fd signals initialization, and the --exit-fd allows for controlled termination.

```bash
# Create pipes for synchronization
exec 3<>/tmp/ready_pipe
exec 4<>/tmp/exit_pipe

# Start slirp4netns with ready-fd and exit-fd
slirp4netns --configure --ready-fd=3 --exit-fd=4 $(cat /tmp/pid) tap0 &

# Wait for ready signal (slirp4netns writes "1" when initialized)
read -t 10 ready_signal <&3
echo "slirp4netns is ready: $ready_signal"

# To terminate slirp4netns, write to exit-fd or close it
exec 4>&-
```

--------------------------------

### BESS Mode (User Mode Linux)

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Configure slirp4netns to act as a BESS-compatible server for providing network connectivity to User Mode Linux (UML) instances.

```APIDOC
## BESS Mode (User Mode Linux)

### Connecting to User Mode Linux

slirp4netns can act as a BESS-compatible server for providing network connectivity to User Mode Linux instances.

**Terminal 1: Start slirp4netns in BESS mode**

```bash
slirp4netns --target-type=bess /tmp/bess.sock
```

**Expected Output:**

```
WARNING: BESS mode is experimental
Waiting for connection to /tmp/bess.sock
```

**Terminal 2: Start User Mode Linux with BESS transport**

```bash
linux.uml vec0:transport=bess,dst=/tmp/bess.sock,depth=128,gro=1 \
    root=/dev/root rootfstype=hostfs init=/bin/bash mem=2G
```

**Inside UML: Configure networking**

```bash
ip addr add 10.0.2.100/24 dev vec0
ip link set vec0 up
ip route add default via 10.0.2.2
```
```

--------------------------------

### Configure sysctl for user namespaces

Source: https://github.com/rootless-containers/slirp4netns/blob/master/README.md

These commands adjust system settings to allow for unprivileged user namespace creation, which may be required on certain distributions like Debian or Arch Linux.

```bash
(host)$ sudo sh -c 'echo "user.max_user_namespaces=28633" >> /etc/sysctl.d/userns.conf'
(host)$ [ -f /proc/sys/kernel/unprivileged_userns_clone ] && sudo sh -c 'echo "kernel.unprivileged_userns_clone=1" >> /etc/sysctl.d/userns.conf'
(host)$ sudo sysctl --system
```

--------------------------------

### Expose Ports via add_hostfwd

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Add port forwarding rules to expose guest services to the host using the API socket.

```bash
# Forward host port 8080 to guest port 80 (TCP)
echo '{"execute": "add_hostfwd", "arguments": {"proto": "tcp", "host_addr": "0.0.0.0", "host_port": 8080, "guest_addr": "10.0.2.100", "guest_port": 80}}' | nc -U /tmp/slirp4netns.sock

# Forward with default addresses (host_addr defaults to 0.0.0.0, guest_addr to recommended IP)
echo '{"execute": "add_hostfwd", "arguments": {"proto": "tcp", "host_port": 8080, "guest_port": 80}}' | nc -U /tmp/slirp4netns.sock

# Forward UDP port
echo '{"execute": "add_hostfwd", "arguments": {"proto": "udp", "host_port": 5353, "guest_port": 53}}' | nc -U /tmp/slirp4netns.sock
```

--------------------------------

### Nest Network Namespaces

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Create and configure multiple network namespaces within the slirp4netns namespace for inter-namespace communication.

```bash
# Enter the slirp4netns namespace
nsenter --user --preserve-credentials --net --mount --target $(cat /tmp/pid)

# Create nested namespaces
mount -t tmpfs none /run
ip netns add foo
ip netns add bar

# Create veth pair for inter-namespace communication
ip link add veth-foo type veth peer name veth-bar
ip link set veth-foo netns foo
ip link set veth-bar netns bar
```

--------------------------------

### API Socket Interface

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Manage port forwarding and network configurations at runtime using a QMP-like JSON API over a Unix socket.

```APIDOC
## API Socket Interface

### Enabling the API Socket

Start slirp4netns with the `--api-socket` option to enable the JSON API.

```bash
# Start slirp4netns with API socket
slirp4netns --configure --api-socket /tmp/slirp4netns.sock $(cat /tmp/pid) tap0
```

### Expected Output Snippet

```
* API Socket:      /tmp/slirp4netns.sock
```

### add_hostfwd - Expose a Port

Add a port forwarding rule to expose a guest port on the host. Allows external access to services inside the network namespace.

**Parameters:**
- **proto** (string) - Required - Protocol (tcp or udp).
- **host_addr** (string) - Optional - Host IP address to bind to (defaults to 0.0.0.0).
- **host_port** (integer) - Required - Host port to expose.
- **guest_addr** (string) - Optional - Guest IP address (defaults to recommended IP).
- **guest_port** (integer) - Required - Guest port to forward.

**Request Example (TCP):**

```bash
echo '{"execute": "add_hostfwd", "arguments": {"proto": "tcp", "host_addr": "0.0.0.0", "host_port": 8080, "guest_addr": "10.0.2.100", "guest_port": 80}}' | nc -U /tmp/slirp4netns.sock
```

**Response Example:**

```json
{"return": {"id": 1}}
```

**Request Example (UDP):**

```bash
echo '{"execute": "add_hostfwd", "arguments": {"proto": "udp", "host_port": 5353, "guest_port": 53}}' | nc -U /tmp/slirp4netns.sock
```

### list_hostfwd - List Exposed Ports

Query all currently configured port forwarding rules.

**Request Example:**

```bash
echo '{"execute": "list_hostfwd"}' | nc -U /tmp/slirp4netns.sock
```

**Response Example:**

```json
{"entries": [
  {"id": 1, "proto": "tcp", "host_addr": "0.0.0.0", "host_port": 8080, "guest_addr": "10.0.2.100", "guest_port": 80},
  {"id": 2, "proto": "tcp", "host_addr": "0.0.0.0", "host_port": 8080, "guest_addr": "10.0.2.100", "guest_port": 80},
  {"id": 3, "proto": "udp", "host_addr": "0.0.0.0", "host_port": 5353, "guest_addr": "10.0.2.100", "guest_port": 53}
]}
```

### remove_hostfwd - Remove an Exposed Port

Remove a port forwarding rule by its ID.

**Parameters:**
- **id** (integer) - Required - The ID of the port forward rule to remove.

**Request Example:**

```bash
echo '{"execute": "remove_hostfwd", "arguments": {"id": 1}}' | nc -U /tmp/slirp4netns.sock
```

**Response Example (Success):**

```json
{"return": {}}
```

**Response Example (Error):**

```bash
echo '{"execute": "remove_hostfwd", "arguments": {"id": 999}}' | nc -U /tmp/slirp4netns.sock
```

```json
{"error": {"desc": "bad request: remove_hostfwd: bad arguments.id"}}
```
```

--------------------------------

### Enable IPv6 Support

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Enables IPv6 networking in addition to the default IPv4 support. This is an experimental feature.

```bash
# Enable IPv6 support
slirp4netns --configure --enable-ipv6 $(cat /tmp/pid) tap0

# Expected output includes:

```

--------------------------------

### Manage Host Forwarding via API

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Commands to add, list, and remove port forwarding rules using the slirp4netns API socket.

```console
(namespace)$ json='{"execute": "add_hostfwd", "arguments": {"proto": "tcp", "host_addr": "0.0.0.0", "host_port": 8080, "guest_addr": "10.0.2.100", "guest_port": 80}}'
(namespace)$ echo -n $json | nc -U /tmp/slirp4netns.sock
{"return": {"id": 42}}
```

```console
(namespace)$ json='{"execute": "list_hostfwd"}'
(namespace)$ echo -n $json | nc -U /tmp/slirp4netns.sock
{"return": {"entries": [{"id": 42, "proto": "tcp", "host_addr": "0.0.0.0", "host_port": 8080, "guest_addr": "10.0.2.100", "guest_port": 80}]}}
```

```console
(namespace)$ json='{"execute": "remove_hostfwd", "arguments": {"id": 42}}'
(namespace)$ echo -n $json | nc -U /tmp/slirp4netns.sock
{"return": {}}
```

--------------------------------

### Network Namespace Configuration

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Configure network namespace types and user namespace paths.

```APIDOC
## Network Namespace Configuration

### Network Namespace Type
Users can define the network namespace path instead of the default process ID.

```console
(host)$ slirp4netns --netns-type=path ... /path/to/netns tap0
```

The `netns-type=TYPE` argument supports `path` or `pid` values, with `pid` being the default.

### User Namespace Path
An optional `--userns-path=PATH` argument can be included to override any user namespace path defaults.

```console
(host)$ slirp4netns --netns-type=path --userns-path=/path/to/userns /path/to/netns tap0
```
```

--------------------------------

### Clone Parson Repository

Source: https://github.com/rootless-containers/slirp4netns/blob/master/vendor/parson/README.md

Clone the Parson repository to your local machine.

```bash
git clone https://github.com/kgabis/parson.git
```

--------------------------------

### List Exposed Ports via list_hostfwd

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Query all currently configured port forwarding rules through the API socket.

```bash
echo '{"execute": "list_hostfwd"}' | nc -U /tmp/slirp4netns.sock
```

--------------------------------

### add_hostfwd API

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Expose a port (IPv4 only) using the add_hostfwd command.

```APIDOC
## POST /api/add_hostfwd

### Description
Expose a port (IPv4 only) to the host.

### Method
POST

### Endpoint
`/` (via UNIX socket)

### Parameters
#### Request Body
- **execute** (string) - Required - The command to execute, "add_hostfwd".
- **arguments** (object) - Required - Arguments for the command.
  - **proto** (string) - Required - Protocol, e.g., "tcp".
  - **host_addr** (string) - Optional - Host IP address to bind to. Defaults to "0.0.0.0".
  - **host_port** (integer) - Required - Host port to expose.
  - **guest_addr** (string) - Optional - Guest IP address to forward to. Defaults to the address corresponding to `--configure`.
  - **guest_port** (integer) - Required - Guest port to forward to.

### Request Example
```json
{
  "execute": "add_hostfwd",
  "arguments": {
    "proto": "tcp",
    "host_addr": "0.0.0.0",
    "host_port": 8080,
    "guest_addr": "10.0.2.100",
    "guest_port": 80
  }
}
```

### Response
#### Success Response (200)
- **return** (object) - Contains the forwarded port ID.
  - **id** (integer) - The ID of the newly created host forward rule.

#### Response Example
```json
{
  "return": {
    "id": 42
  }
}
```
```

--------------------------------

### Inter-Namespace Communication

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Methods for connecting namespaces, either by nesting them or using vde_plug for cross-instance communication.

```console
(host)$ nsenter -t $(cat /tmp/pid) -U --preserve-credentials -n -m
(namespace)$ mount -t tmpfs none /run
(namespace)$ ip netns add foo
(namespace)$ ip netns add bar
(namespace)$ ip link add veth-foo type veth peer name veth-bar
(namespace)$ ip link set veth-foo netns foo
(namespace)$ ip link set veth-bar netns bar
(namespace)$ ip netns exec foo ip link set veth-foo name eth0
(namespace)$ ip netns exec bar ip link set veth-bar name eth0
(namespace)$ ip netns exec foo ip link set lo up
(namespace)$ ip netns exec bar ip link set lo up
(namespace)$ ip netns exec foo ip link set eth0 up
(namespace)$ ip netns exec bar ip link set eth0 up
(namespace)$ ip netns exec foo ip addr add 192.168.42.100/24 dev eth0
(namespace)$ ip netns exec bar ip addr add 192.168.42.101/24 dev eth0
(namespace)$ ip netns exec bar ping 192.168.42.100
```

```console
(host)$ vde_plug --daemon switch:///tmp/switch null://
(host)$ nsenter -t $(cat /tmp/pid-instance0) -U --preserve-credentials -n
(namespace-instance0)$ vde_plug --daemon vde:///tmp/switch tap://vde
(namespace-instance0)$ ip link set vde up
(namespace-instance0)$ ip addr add 192.168.42.100/24 dev vde
(namespace-instance0)$ exit
(host)$ nsenter -t $(cat /tmp/pid-instance1) -U --preserve-credentials -n
(namespace-instance1)$ vde_plug --daemon vde:///tmp/switch tap://vde
(namespace-instance1)$ ip link set vde up
(namespace-instance1)$ ip addr add 192.168.42.101/24 dev vde
(namespace-instance1)$ ping 192.168.42.100
```

--------------------------------

### Sandbox and Seccomp Security

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Enables additional security measures by activating sandbox mode, which creates a new mount namespace and drops capabilities. Seccomp system call filtering can be enabled for maximum security, though it is experimental.

```bash
# Enable sandbox mode (creates new mount namespace, drops capabilities)
slirp4netns --configure --enable-sandbox $(cat /tmp/pid) tap0

# Enable both sandbox and seccomp for maximum security
slirp4netns --configure --enable-sandbox --enable-seccomp $(cat /tmp/pid) tap0

# Expected output includes:
# WARNING: Support for seccomp is experimental
```

--------------------------------

### Custom CIDR Network Configuration

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Configures slirp4netns with a custom network address range using the --cidr option for non-default IP allocation. Verify the custom IP assignment within the target namespace.

```bash
# Start slirp4netns with a custom network range
slirp4netns --configure --cidr 10.0.135.128/25 $(cat /tmp/pid) tap0

# Expected output:
# Starting slirp
# * MTU:             1500
# * Network:         10.0.135.128
# * Netmask:         255.255.255.128
# * Gateway:         10.0.135.130
# * DNS:             10.0.135.131
# * Recommended IP:  10.0.135.228

# Verify the custom IP assignment
nsenter --user --net --target $(cat /tmp/pid) ip addr show tap0
# inet 10.0.135.228/25 brd 10.0.135.255 scope global tap0
```

--------------------------------

### list_hostfwd API

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

List all currently exposed ports using the list_hostfwd command.

```APIDOC
## GET /api/list_hostfwd

### Description
List all currently exposed ports.

### Method
GET

### Endpoint
`/` (via UNIX socket)

### Parameters
#### Request Body
- **execute** (string) - Required - The command to execute, "list_hostfwd".

### Request Example
```json
{
  "execute": "list_hostfwd"
}
```

### Response
#### Success Response (200)
- **return** (object) - Contains a list of host forward entries.
  - **entries** (array) - List of host forward rules.
    - **id** (integer) - The ID of the host forward rule.
    - **proto** (string) - Protocol, e.g., "tcp".
    - **host_addr** (string) - Host IP address.
    - **host_port** (integer) - Host port.
    - **guest_addr** (string) - Guest IP address.
    - **guest_port** (integer) - Guest port.

#### Response Example
```json
{
  "return": {
    "entries": [
      {
        "id": 42,
        "proto": "tcp",
        "host_addr": "0.0.0.0",
        "host_port": 8080,
        "guest_addr": "10.0.2.100",
        "guest_port": 80
      }
    ]
  }
}
```
```

--------------------------------

### Network Namespace Path Mode

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Uses a path to a network namespace file instead of a process ID. This mode is useful for persistent network namespaces. An optional user namespace path can also be specified.

```bash
# Create a persistent network namespace
ip netns add mynetns

# Start slirp4netns using the namespace path
slirp4netns --netns-type=path --configure /var/run/netns/mynetns tap0

# Optionally specify a user namespace path
slirp4netns --netns-type=path --userns-path=/proc/1000/ns/user \
    --configure /var/run/netns/mynetns tap0
```

--------------------------------

### Set Outbound Addresses

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Specify preferred outbound IPv4/IPv6 addresses or interface names for multi-IP scenarios.

```console
(host)$ slirp4netns --outbound-addr=10.2.2.10 --outbound-addr6=fe80::10 ...
```

```console
(host)$ slirp4netns --outbound-addr=eth0 --outbound-addr6=eth0 ...
```

--------------------------------

### Configure Outbound Address Binding

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Bind outgoing connections to specific IPv4/IPv6 addresses or network interfaces. Note that this feature is experimental.

```bash
# Bind to a specific IPv4 address
slirp4netns --configure --outbound-addr=192.168.1.100 $(cat /tmp/pid) tap0

# Bind to a network interface
slirp4netns --configure --outbound-addr=eth0 $(cat /tmp/pid) tap0

# Bind IPv6 outbound address
slirp4netns --configure --outbound-addr6=fe80::10 $(cat /tmp/pid) tap0
```

--------------------------------

### slirp4netns API Socket

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

slirp4netns can provide a QMP-like API server over a UNIX socket file. Clients need to shut down the socket after sending each request.

```APIDOC
## slirp4netns API Socket

slirp4netns can provide a QMP-like API server over a UNIX socket file.

```console
(host)$ slirp4netns --api-socket /tmp/slirp4netns.sock ...
```

**Remarks:**
* Client needs to `shutdown(2)` the socket with `SHUT_WR` after sending every request.
* slirp4netns "stops the world" during processing API requests.
* A request must be less than 4096 bytes.
* JSON responses may contain `error` instead of `return`.
```

--------------------------------

### Enable ping packet routing

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Adjusts system ping group range to allow ping packets to be routed.

```console
(host)$ sudo sh -c 'echo "net.ipv4.ping_group_range=0   2147483647" > /etc/sysctl.d/ping_group_range.conf'
(host)$ sudo sysctl --system
```

--------------------------------

### Outbound Address Binding (Experimental)

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Configure slirp4netns to bind outgoing connections to a specific IP address or network interface. IPv6 outbound binding is also supported.

```APIDOC
## Outbound Address Binding (Experimental)

Bind outgoing connections to a specific IP address or interface.

### Command Examples

```bash
# Bind to a specific IPv4 address
slirp4netns --configure --outbound-addr=192.168.1.100 $(cat /tmp/pid) tap0

# Bind to a network interface
slirp4netns --configure --outbound-addr=eth0 $(cat /tmp/pid) tap0

# Bind IPv6 outbound address
slirp4netns --configure --outbound-addr6=fe80::10 $(cat /tmp/pid) tap0
```

### Expected Output Snippet

```
WARNING: Support for --outbound-addr is experimental
* Outbound IPv4:    192.168.1.100
```
```

--------------------------------

### Custom MAC Address Configuration

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Assigns a specific MAC address to the TAP interface when using the --configure option. The MAC address format must be valid.

```bash
# Set a specific MAC address
slirp4netns --configure --macaddress=02:42:ac:11:00:02 $(cat /tmp/pid) tap0

# Expected output includes:
# * MAC address:     02:42:ac:11:00:02
```

--------------------------------

### Workaround for slirp4netns Port Forwarding Slowdown

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Adjusts the `/proc/sys/net/ipv4/tcp_rmem` value within a network namespace to mitigate slowdowns in slirp4netns port forwarding caused by a kernel bump. This requires entering the namespace using `nsenter`.

```console
(host)$ nsenter -t $(cat /tmp/pid) -U --preserve-credentials -n -m
(namespace)$ c=$(cat /proc/sys/net/ipv4/tcp_rmem); echo $c | sed -e s/131072/87380/g > /proc/sys/net/ipv4/tcp_rmem
```

--------------------------------

### Outbound Address Configuration

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Define preferred outbound IPv4 and IPv6 addresses for multi-IP scenarios.

```APIDOC
## Outbound Addresses

Users can define preferred outbound IPv4 and IPv6 addresses in multi-IP scenarios.

```console
(host)$ slirp4netns --outbound-addr=10.2.2.10 --outbound-addr6=fe80::10 ...
```

Optionally, interface names can be used instead of IP addresses.

```console
(host)$ slirp4netns --outbound-addr=eth0 --outbound-addr6=eth0 ...
```
```

--------------------------------

### Inter-Namespace Communication

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Enable communication between multiple network namespaces nested within the slirp4netns environment.

```APIDOC
## Inter-Namespace Communication

### Nesting Network Namespaces

Create multiple network namespaces that can communicate with each other inside slirp4netns's namespace.

**Enter the slirp4netns namespace:**

```bash
nsenter --user --preserve-credentials --net --mount --target $(cat /tmp/pid)
```

**Create nested namespaces:**

```bash
mount -t tmpfs none /run
ip netns add foo
ip netns add bar
```

**Create veth pair for inter-namespace communication:**

```bash
ip link add veth-foo type veth peer name veth-bar
ip link set veth-foo netns foo
ip link set veth-bar netns bar
```
```

--------------------------------

### Inter-Host Communication

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Information on enabling communication between hosts.

```APIDOC
## Inter-Host Communication

VXLAN is known to work for inter-host communication.

See the Usernetes project for an example of a multi-node rootless Kubernetes cluster with VXLAN: `https://github.com/rootless-containers/usernetes`
```

--------------------------------

### Inter-Namespace Communication

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Methods for enabling communication between network namespaces.

```APIDOC
## Inter-Namespace Communication

### Nested Network Namespaces
The easiest way to allow inter-namespace communication is to nest network namespaces inside the slirp4netns's network namespace.

```console
(host)$ nsenter -t $(cat /tmp/pid) -U --preserve-credentials -n -m
(namespace)$ mount -t tmpfs none /run
(namespace)$ ip netns add foo
(namespace)$ ip netns add bar
(namespace)$ ip link add veth-foo type veth peer name veth-bar
(namespace)$ ip link set veth-foo netns foo
(namespace)$ ip link set veth-bar netns bar
(namespace)$ ip netns exec foo ip link set veth-foo name eth0
(namespace)$ ip netns exec bar ip link set veth-bar name eth0
(namespace)$ ip netns exec foo ip link set lo up
(namespace)$ ip netns exec bar ip link set lo up
(namespace)$ ip netns exec foo ip link set eth0 up
(namespace)$ ip netns exec bar ip link set eth0 up
(namespace)$ ip netns exec foo ip addr add 192.168.42.100/24 dev eth0
(namespace)$ ip netns exec bar ip addr add 192.168.42.101/24 dev eth0
(namespace)$ ip netns exec bar ping 192.168.42.100
```

### Communication Across Multiple slirp4netns Instances
To allow communication across multiple slirp4netns instances, combine with another network stack like `vde_plug(1)`.

```console
(host)$ vde_plug --daemon switch:///tmp/switch null://
(host)$ nsenter -t $(cat /tmp/pid-instance0) -U --preserve-credentials -n
(namespace-instance0)$ vde_plug --daemon vde:///tmp/switch tap://vde
(namespace-instance0)$ ip link set vde up
(namespace-instance0)$ ip addr add 192.168.42.100/24 dev vde
(namespace-instance0)$ exit
(host)$ nsenter -t $(cat /tmp/pid-instance1) -U --preserve-credentials -n
(namespace-instance1)$ vde_plug --daemon vde:///tmp/switch tap://vde
(namespace-instance1)$ ip link set vde up
(namespace-instance1)$ ip addr add 192.168.42.101/24 dev vde
(namespace-instance1)$ ping 192.168.42.100
```
```

--------------------------------

### API Error Handling

Source: https://context7.com/rootless-containers/slirp4netns/llms.txt

Understand the structured JSON error responses from the slirp4netns API for various invalid requests.

```APIDOC
## API Error Handling

The API returns structured JSON errors for invalid requests.

### Invalid JSON

```bash
echo 'not json' | nc -U /tmp/slirp4netns.sock
```

**Response:**

```json
{"error": {"desc": "bad request: cannot parse JSON"}}
```

### Missing execute field

```bash
echo '{"foo": "bar"}' | nc -U /tmp/slirp4netns.sock
```

**Response:**

```json
{"error": {"desc": "bad request: no execute found"}}
```

### Unknown command

```bash
echo '{"execute": "unknown_command"}' | nc -U /tmp/slirp4netns.sock
```

**Response:**

```json
{"error": {"desc": "bad request: unknown execute"}}
```

### Invalid protocol

```bash
echo '{"execute": "add_hostfwd", "arguments": {"proto": "invalid", "host_port": 80, "guest_port": 80}}' | nc -U /tmp/slirp4netns.sock
```

**Response:**

```json
{"error": {"desc": "bad request: add_hostfwd: bad arguments.proto"}}
```
```

--------------------------------

### Filter DNS connections with iptables

Source: https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md

Restricts access to the built-in DNS server from within the namespace.

```console
(host)$ nsenter -t $(cat /tmp/pid) -U --preserve-credentials -n
(namespace)$ iptables -A OUTPUT -d 10.0.2.3 -p udp --dport 53 -j ACCEPT
(namespace)$ iptables -A OUTPUT -d 10.0.2.3 -j DROP
```