these 27 derivations will be built:
  /nix/store/0hh0q2la2ilrj3icbfbmwv72c4ackzvf-nftables-cleanup-deletions.drv
  /nix/store/11nrzy8dc6pvpjjr01ax74arfdjrpmsw-test-script.drv
  /nix/store/znr2fib5pv7vrxhfy9c55r02qdfmln12-nftables-deletions.drv
  /nix/store/25n2wf8ydkvyy43phj1p6s3isizwvy11-nftables-save-deletions.drv
  /nix/store/4vwl196am36nz1r0j6bqm1hw6zpgq3dw-nftables-ensure-deletions.drv
  /nix/store/wbrir5ga35148j8sxmpk5gci7si3gqn8-system-units.drv
  /nix/store/6xv0kwiky2wrp2wdp53m0ljjqq4l4w51-etc.drv
  /nix/store/f0qb0jdxzq0dq64wbw5ys6lzl5ba6hfg-activate.drv
  /nix/store/6qg0diii18lhx47lf67d95i4z90v76yw-nixos-system-router-test.drv
  /nix/store/rplvwdq22pcvxadhv4cblinkb1ds094j-system-path.drv
  /nix/store/rn3g99z18cqwpq3b6mfk0g7m9s28nrjd-dbus-1.drv
  /nix/store/qhn4kz9jjk1l759zala5p9wihdk5rp5f-X-Restart-Triggers-dbus-broker.drv
  /nix/store/rx1zw9v25ylpj4isbg0qmbc869f1zzbh-unit-dbus-broker.service.drv
  /nix/store/gkipw060l5xdy3b4z6867g7gm4k12728-user-units.drv
  /nix/store/a7987km271ns7v53niicbka4mldcb5bb-unit-dbus-broker.service.drv
  /nix/store/xnyk69sxyly2qbm9xd2r2m8wl6qjbsqv-passwd.drv
  /nix/store/icy8zcf2xvivwiq3d576vl29rm0377sc-nftables-rules.drv
  /nix/store/wgsg7niizhvs50kngpql5q9yw0lv5av9-unit-nftables.service.drv
  /nix/store/namskzgni4b86488hrnzji31lpb5mlxm-system-units.drv
  /nix/store/r8mf38lq9i5la5frsr793kzjvp47v5ya-etc.drv
  /nix/store/dvps9r9anyfg3y1bdxpxrws9l7rbzqml-activate.drv
  /nix/store/6r8nnilmk74jj4zgz0i802as8sx8vfkm-nixos-system-machine-test.drv
  /nix/store/j4irsqa37cvwzzl2laic626bq47b7mi8-run-router-nspawn.drv
  /nix/store/y2kb630m96jws7dn9yys9izxkf39fq53-run-machine-nspawn.drv
  /nix/store/j519fdh9xvhglr1x245bdrgjjwhhkp74-driverConfiguration.json.drv
  /nix/store/hxq5akmf5qzlg4kbp8b1zpns1ni34c7m-nixos-test-driver-user-firewall-nftables.drv
  /nix/store/8y0baxnvvpky1rlfv4nqayk6aykqcl7m-container-test-run-user-firewall-nftables.drv
this path will be fetched (18.1 MiB download, 52.1 MiB unpacked):
  /nix/store/dciy7h7hlyq06n2f9brylsi1z945w1r2-lkl-2025-11-13-lib
building '/nix/store/11nrzy8dc6pvpjjr01ax74arfdjrpmsw-test-script.drv'
building '/nix/store/rplvwdq22pcvxadhv4cblinkb1ds094j-system-path.drv'
building '/nix/store/0hh0q2la2ilrj3icbfbmwv72c4ackzvf-nftables-cleanup-deletions.drv'
building '/nix/store/4vwl196am36nz1r0j6bqm1hw6zpgq3dw-nftables-ensure-deletions.drv'
building '/nix/store/znr2fib5pv7vrxhfy9c55r02qdfmln12-nftables-deletions.drv'
building '/nix/store/xnyk69sxyly2qbm9xd2r2m8wl6qjbsqv-passwd.drv'
system-path> structuredAttrs is enabled
system-path> created 1579 symlinks in user environment
building '/nix/store/25n2wf8ydkvyy43phj1p6s3isizwvy11-nftables-save-deletions.drv'
building '/nix/store/rn3g99z18cqwpq3b6mfk0g7m9s28nrjd-dbus-1.drv'
building '/nix/store/qhn4kz9jjk1l759zala5p9wihdk5rp5f-X-Restart-Triggers-dbus-broker.drv'
building '/nix/store/icy8zcf2xvivwiq3d576vl29rm0377sc-nftables-rules.drv'
building '/nix/store/a7987km271ns7v53niicbka4mldcb5bb-unit-dbus-broker.service.drv'
building '/nix/store/rx1zw9v25ylpj4isbg0qmbc869f1zzbh-unit-dbus-broker.service.drv'
unit-dbus-broker.service> structuredAttrs is enabled
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/wgsg7niizhvs50kngpql5q9yw0lv5av9-unit-nftables.service.drv'
building '/nix/store/gkipw060l5xdy3b4z6867g7gm4k12728-user-units.drv'
unit-nftables.service> structuredAttrs is enabled
building '/nix/store/namskzgni4b86488hrnzji31lpb5mlxm-system-units.drv'
building '/nix/store/r8mf38lq9i5la5frsr793kzjvp47v5ya-etc.drv'
building '/nix/store/dvps9r9anyfg3y1bdxpxrws9l7rbzqml-activate.drv'
building '/nix/store/6r8nnilmk74jj4zgz0i802as8sx8vfkm-nixos-system-machine-test.drv'
nixos-system-machine-test> structuredAttrs is enabled
building '/nix/store/y2kb630m96jws7dn9yys9izxkf39fq53-run-machine-nspawn.drv'
building '/nix/store/j519fdh9xvhglr1x245bdrgjjwhhkp74-driverConfiguration.json.drv'
driverConfiguration.json> structuredAttrs is enabled
building '/nix/store/hxq5akmf5qzlg4kbp8b1zpns1ni34c7m-nixos-test-driver-user-firewall-nftables.drv'
nixos-test-driver-user-firewall-nftables> Running type check (enable/disable: config.skipTypeCheck)
nixos-test-driver-user-firewall-nftables> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck
nixos-test-driver-user-firewall-nftables> All checks passed!
nixos-test-driver-user-firewall-nftables> Linting test script (enable/disable: config.skipLint)
nixos-test-driver-user-firewall-nftables> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint
nixos-test-driver-user-firewall-nftables> All checks passed!
building '/nix/store/8y0baxnvvpky1rlfv4nqayk6aykqcl7m-container-test-run-user-firewall-nftables.drv' on 'ssh-ng://builder@build-x86-01.clan.lol'
building '/nix/store/8y0baxnvvpky1rlfv4nqayk6aykqcl7m-container-test-run-user-firewall-nftables.drv'
container-test-run-user-firewall-nftables> Machine state will be reset. To keep it, pass --keep-machine-state
container-test-run-user-firewall-nftables> start all VLans
container-test-run-user-firewall-nftables> (finished: start all VLans, in 0.00 seconds)
container-test-run-user-firewall-nftables> 
container-test-run-user-firewall-nftables> Test will time out and terminate in 3600.0 seconds
container-test-run-user-firewall-nftables> run the VM test script
container-test-run-user-firewall-nftables> additionally exposed symbols:
container-test-run-user-firewall-nftables>     machine, router,
container-test-run-user-firewall-nftables>     vlan1,
container-test-run-user-firewall-nftables>     start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh
container-test-run-user-firewall-nftables> start all VMs
container-test-run-user-firewall-nftables> router: systemd-nspawn running (pid 53)
container-test-run-user-firewall-nftables> machine: systemd-nspawn running (pid 52)
container-test-run-user-firewall-nftables> router: Waiting for journal at /build/vm-state-router/var/log/journal...
container-test-run-user-firewall-nftables> machine: Waiting for journal at /build/vm-state-machine/var/log/journal...
container-test-run-user-firewall-nftables> (finished: start all VMs, in 0.00 seconds)
container-test-run-user-firewall-nftables> router: waiting for unit multi-user.target
container-test-run-user-firewall-nftables> nixos-nspawn(machine): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-user-firewall-nftables> nixos-nspawn(machine): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-user-firewall-nftables> nixos-nspawn(router): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-user-firewall-nftables> nixos-nspawn(router): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-user-firewall-nftables> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-user-firewall-nftables> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-user-firewall-nftables> ░ Spawning container machine on /build/vm-state-machine.
container-test-run-user-firewall-nftables> ░ Spawning container router on /build/vm-state-router.
container-test-run-user-firewall-nftables> router # [7812198.316404] router systemd-journald[54]: Journal started
container-test-run-user-firewall-nftables> router # [7812198.316431] router systemd-journald[54]: Runtime Journal (/run/log/journal/a1ee112b5d3a4e98a94e2be8c9e6ac17) is 8M, max 3.7G, 3.7G free.
container-test-run-user-firewall-nftables> router # [7812198.372820] router systemd[1]: Finished Apply Kernel Variables.
container-test-run-user-firewall-nftables> router # [7812198.399555] router systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-user-firewall-nftables> router # [7812198.420595] router systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-user-firewall-nftables> router # [7812198.421312] router systemd[1]: Starting Network Name Resolution...
container-test-run-user-firewall-nftables> machine # [7812198.288667] machine systemd-journald[54]: Journal started
container-test-run-user-firewall-nftables> router # [7812198.422157] router systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-user-firewall-nftables> machine # [7812198.288699] machine systemd-journald[54]: Runtime Journal (/run/log/journal/58e22dd24c234f51a9acf46e76530bda) is 8M, max 3.7G, 3.7G free.
container-test-run-user-firewall-nftables> router # [7812198.428151] router systemd-journald[54]: Time spent on flushing to /var/log/journal/a1ee112b5d3a4e98a94e2be8c9e6ac17 is 1.745ms for 7 entries.
container-test-run-user-firewall-nftables> machine # [7812198.311693] machine systemd[1]: Finished Apply Kernel Variables.
container-test-run-user-firewall-nftables> router # [7812198.428151] router systemd-journald[54]: System Journal (/var/log/journal/a1ee112b5d3a4e98a94e2be8c9e6ac17) is 8M, max 4G, 3.9G free.
container-test-run-user-firewall-nftables> machine # [7812198.328546] machine systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-user-firewall-nftables> router # [7812198.531662] router systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-user-firewall-nftables> machine # [7812198.375138] machine systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-user-firewall-nftables> router # [7812198.532077] router systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-user-firewall-nftables> machine # [7812198.375612] machine systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-user-firewall-nftables> router # [7812198.533256] router systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-user-firewall-nftables> machine # [7812198.395427] machine systemd-journald[54]: Time spent on flushing to /var/log/journal/58e22dd24c234f51a9acf46e76530bda is 1.333ms for 6 entries.
container-test-run-user-firewall-nftables> machine # [7812198.395427] machine systemd-journald[54]: System Journal (/var/log/journal/58e22dd24c234f51a9acf46e76530bda) is 8M, max 4G, 3.9G free.
container-test-run-user-firewall-nftables> machine # [7812198.413264] machine systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-user-firewall-nftables> machine # [7812198.414120] machine systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-user-firewall-nftables> machine # [7812198.414204] machine systemd[1]: Reached target Local File Systems.
container-test-run-user-firewall-nftables> machine # [7812198.414885] machine systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-user-firewall-nftables> machine # [7812198.414922] machine systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-user-firewall-nftables> machine # [7812198.416050] machine systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-user-firewall-nftables> machine # [7812198.416078] machine systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-user-firewall-nftables> machine # [7812198.439705] machine systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-user-firewall-nftables> machine # [7812198.440372] machine systemd[1]: Starting Create System Files and Directories...
container-test-run-user-firewall-nftables> machine # [7812198.455831] machine systemd-tmpfiles[66]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-user-firewall-nftables> machine # [7812198.455994] machine systemd-tmpfiles[66]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-user-firewall-nftables> machine # [7812198.456108] machine systemd-tmpfiles[66]: fchmod() of /var/log/journal/58e22dd24c234f51a9acf46e76530bda failed: Operation not permitted
container-test-run-user-firewall-nftables> machine # [7812198.456265] machine systemd-tmpfiles[66]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-user-firewall-nftables> machine # [7812198.457836] machine systemd[1]: Finished Create System Files and Directories.
container-test-run-user-firewall-nftables> machine # [7812198.458832] machine systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-user-firewall-nftables> machine # [7812198.459484] machine systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-user-firewall-nftables> machine # [7812198.467324] machine systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-user-firewall-nftables> machine # [7812198.474780] machine systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-user-firewall-nftables> machine # [7812198.475429] machine systemd[1]: Starting Update is Completed...
container-test-run-user-firewall-nftables> machine # [7812198.483340] machine systemd[1]: Finished Update is Completed.
container-test-run-user-firewall-nftables> machine # [7812198.483466] machine systemd[1]: Reached target System Initialization.
container-test-run-user-firewall-nftables> machine # [7812198.483521] machine systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-user-firewall-nftables> machine # [7812198.483549] machine systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-user-firewall-nftables> machine # [7812198.483561] machine systemd[1]: Reached target Timer Units.
container-test-run-user-firewall-nftables> machine # [7812198.483647] machine systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-user-firewall-nftables> machine # [7812198.483726] machine systemd[1]: Listening on Nix Daemon Socket.
container-test-run-user-firewall-nftables> machine # [7812198.483797] machine systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-user-firewall-nftables> machine # [7812198.483808] machine systemd[1]: Reached target Socket Units.
container-test-run-user-firewall-nftables> machine # [7812198.483834] machine systemd[1]: Reached target Basic System.
container-test-run-user-firewall-nftables> machine # [7812198.484549] machine systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-user-firewall-nftables> machine # [7812198.485184] machine systemd[1]: Starting nftables firewall...
container-test-run-user-firewall-nftables> machine # [7812198.485848] machine systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-user-firewall-nftables> machine # [7812198.497899] machine systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-user-firewall-nftables> machine # [7812198.572717] machine systemd[1]: Finished nftables firewall.
container-test-run-user-firewall-nftables> machine # [7812198.572862] machine systemd[1]: Reached target Preparation for Network.
container-test-run-user-firewall-nftables> machine # [7812198.573735] machine systemd[1]: Starting Address configuration of eth1...
container-test-run-user-firewall-nftables> machine # [7812198.574536] machine systemd[1]: Starting Extra networking commands....
container-test-run-user-firewall-nftables> machine # [7812198.575009] machine systemd[1]: Starting Setup wg0 dummy interface...
container-test-run-user-firewall-nftables> router # [7812198.533326] router systemd[1]: Reached target Local File Systems.
container-test-run-user-firewall-nftables> router # [7812198.534238] router systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-user-firewall-nftables> router # [7812198.534282] router systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-user-firewall-nftables> router # [7812198.560223] router systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-user-firewall-nftables> router # [7812198.560912] router systemd[1]: Starting Create System Files and Directories...
container-test-run-user-firewall-nftables> router # [7812198.560934] router systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-user-firewall-nftables> router # [7812198.561712] router systemd[1]: Starting Network Management...
container-test-run-user-firewall-nftables> router # [7812198.572830] router systemd-tmpfiles[68]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-user-firewall-nftables> router # [7812198.573043] router systemd-tmpfiles[68]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-user-firewall-nftables> router # [7812198.573179] router systemd-tmpfiles[68]: fchmod() of /var/log/journal/a1ee112b5d3a4e98a94e2be8c9e6ac17 failed: Operation not permitted
container-test-run-user-firewall-nftables> router # [7812198.573355] router systemd-tmpfiles[68]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-user-firewall-nftables> router # [7812198.580278] router systemd[1]: Finished Create System Files and Directories.
container-test-run-user-firewall-nftables> router # [7812198.581048] router systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-user-firewall-nftables> machine # [7812198.586250] machine network-addresses-eth1-start[91]: adding address 192.168.1.1/24... done
container-test-run-user-firewall-nftables> machine # [7812198.588008] machine network-addresses-eth1-start[91]: adding address 2001:db8:1::1/64... done
container-test-run-user-firewall-nftables> machine # [7812198.588980] machine systemd[1]: Finished Setup wg0 dummy interface.
container-test-run-user-firewall-nftables> machine # [7812198.590881] machine systemd[1]: Finished Address configuration of eth1.
container-test-run-user-firewall-nftables> machine # [7812198.625796] machine systemd[1]: nscd.service: Deactivated successfully.
container-test-run-user-firewall-nftables> machine # [7812198.625902] machine systemd[1]: Stopped Name Service Cache Daemon (nsncd).
container-test-run-user-firewall-nftables> machine # [7812198.626824] machine systemd[1]: Finished Extra networking commands..
container-test-run-user-firewall-nftables> machine # [7812198.627017] machine systemd[1]: Reached target Network.
container-test-run-user-firewall-nftables> machine # [7812198.628201] machine systemd[1]: Starting Nginx Web Server...
container-test-run-user-firewall-nftables> machine # [7812198.628709] machine systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-user-firewall-nftables> router # [7812198.581550] router systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-user-firewall-nftables> router # [7812198.591350] router systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-user-firewall-nftables> router # [7812198.599388] router systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-user-firewall-nftables> router # [7812198.600153] router systemd[1]: Starting Update is Completed...
container-test-run-user-firewall-nftables> router # [7812198.626674] router systemd[1]: Finished Update is Completed.
container-test-run-user-firewall-nftables> router # [7812198.674263] router systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-user-firewall-nftables> machine # [7812198.674928] machine systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-user-firewall-nftables> machine # [7812199.027662] machine nsncd[163]: Aug 29 20:04:16.393 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-user-firewall-nftables> machine # [7812199.027745] machine systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-user-firewall-nftables> machine # [7812199.027816] machine systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-user-firewall-nftables> machine # [7812199.027861] machine systemd[1]: Reached target User and Group Name Lookups.
container-test-run-user-firewall-nftables> machine # [7812199.028871] machine systemd[1]: Starting User Login Management...
container-test-run-user-firewall-nftables> machine # [7812199.029488] machine systemd[1]: Starting Permit User Sessions...
container-test-run-user-firewall-nftables> machine # [7812199.048475] machine systemd[1]: Finished Permit User Sessions.
container-test-run-user-firewall-nftables> machine # [7812199.050082] machine systemd[1]: Started Console Getty.
container-test-run-user-firewall-nftables> machine # [7812199.050111] machine systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-user-firewall-nftables> machine # [7812199.050122] machine systemd[1]: Reached target Login Prompts.
container-test-run-user-firewall-nftables> router # [7812199.324440] router systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-user-firewall-nftables> machine # [7812199.311580] machine systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-user-firewall-nftables> router # [7812201.114683] router systemd-networkd[69]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-user-firewall-nftables> router # [7812201.114801] router systemd-networkd[69]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-user-firewall-nftables> router # [7812201.122401] router systemd-networkd[69]: lo: Link UP
container-test-run-user-firewall-nftables> router # [7812201.122408] router systemd-networkd[69]: lo: Gained carrier
container-test-run-user-firewall-nftables> router # [7812201.122622] router systemd-networkd[69]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-user-firewall-nftables> router # [7812201.122996] router systemd[1]: Started Network Management.
container-test-run-user-firewall-nftables> router # [7812201.124210] router systemd-networkd[69]: eth1: Link UP
container-test-run-user-firewall-nftables> router # [7812201.124385] router systemd-networkd[69]: eth1: Gained carrier
container-test-run-user-firewall-nftables> router # [7812201.125147] router systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-user-firewall-nftables> router # [7812201.137917] router systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-user-firewall-nftables> machine # [7812201.329063] machine nginx-pre-start[189]: nginx: the configuration file /nix/store/pn78ibz0jl5fciqc1jh9cq8k3m729427-nginx.conf syntax is ok
container-test-run-user-firewall-nftables> machine # [7812201.329063] machine nginx-pre-start[189]: nginx: configuration file /nix/store/pn78ibz0jl5fciqc1jh9cq8k3m729427-nginx.conf test is successful
container-test-run-user-firewall-nftables> machine # [7812201.333304] machine systemd[1]: Started Nginx Web Server.
container-test-run-user-firewall-nftables> machine # [7812201.538609] machine systemd-logind[179]: New seat seat0.
container-test-run-user-firewall-nftables> machine # [7812201.540513] machine systemd[1]: Starting D-Bus System Message Bus...
container-test-run-user-firewall-nftables> machine # [7812201.540620] machine systemd[1]: Started User Login Management.
container-test-run-user-firewall-nftables> machine # [7812201.543132] machine systemd[1]: Starting linger-users.service...
container-test-run-user-firewall-nftables> machine # [7812201.567849] machine systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-user-firewall-nftables> machine # [7812201.568059] machine systemd[1]: Finished linger-users.service.
container-test-run-user-firewall-nftables> machine # [7812201.568292] machine systemd[1]: Reached target Multi-User System.
container-test-run-user-firewall-nftables> machine # [7812201.858529] machine dbus-broker-launch[195]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-user-firewall-nftables> machine # [7812201.859290] machine dbus-broker-launch[195]: NSS returned no entry for 'systemd-timesync'
container-test-run-user-firewall-nftables> machine # [7812201.859323] machine dbus-broker-launch[195]: Invalid user-name in /nix/store/kl71d502bzsaq92wh7d3dfq1fxkrw64p-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-user-firewall-nftables> machine # [7812201.859758] machine systemd[1]: Started D-Bus System Message Bus.
container-test-run-user-firewall-nftables> machine # [7812201.860070] machine systemd[1]: Startup finished in 3.906s.
container-test-run-user-firewall-nftables> machine # [7812201.864473] machine dbus-broker-launch[195]: Ready
container-test-run-user-firewall-nftables> router # [7812201.907092] router systemd-resolved[61]: Positive Trust Anchors:
container-test-run-user-firewall-nftables> router # [7812201.907103] router systemd-resolved[61]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-user-firewall-nftables> router # [7812201.907107] router systemd-resolved[61]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-user-firewall-nftables> router # [7812201.907130] router systemd-resolved[61]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-user-firewall-nftables> router # [7812201.926117] router systemd-resolved[61]: Using system hostname 'router'.
container-test-run-user-firewall-nftables> router # [7812201.927252] router systemd[1]: Started Network Name Resolution.
container-test-run-user-firewall-nftables> router # [7812201.927333] router systemd[1]: Reached target Network.
container-test-run-user-firewall-nftables> router # [7812201.927390] router systemd[1]: Reached target System Initialization.
container-test-run-user-firewall-nftables> router # [7812201.927437] router systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-user-firewall-nftables> router # [7812201.927462] router systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-user-firewall-nftables> router # [7812201.927477] router systemd[1]: Reached target Timer Units.
container-test-run-user-firewall-nftables> router # [7812201.927607] router systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-user-firewall-nftables> router # [7812201.927708] router systemd[1]: Listening on Nix Daemon Socket.
container-test-run-user-firewall-nftables> router # [7812201.927822] router systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-user-firewall-nftables> router # [7812201.927846] router systemd[1]: Reached target Socket Units.
container-test-run-user-firewall-nftables> router # [7812201.927876] router systemd[1]: Reached target Basic System.
container-test-run-user-firewall-nftables> router # [7812201.928905] router systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-user-firewall-nftables> router # [7812201.929742] router systemd[1]: Starting Nginx Web Server...
container-test-run-user-firewall-nftables> router # [7812201.930425] router systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-user-firewall-nftables> router # [7812201.931490] router systemd[1]: Starting D-Bus System Message Bus...
container-test-run-user-firewall-nftables> router # [7812201.965438] router systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-user-firewall-nftables> router # [7812202.094288] router nsncd[84]: Aug 29 20:04:19.459 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-user-firewall-nftables> router # [7812202.094433] router systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-user-firewall-nftables> router # [7812202.094506] router systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-user-firewall-nftables> router # [7812202.094563] router systemd[1]: Reached target User and Group Name Lookups.
container-test-run-user-firewall-nftables> router # [7812202.095619] router systemd[1]: Starting User Login Management...
container-test-run-user-firewall-nftables> router # [7812202.096344] router systemd[1]: Starting Permit User Sessions...
container-test-run-user-firewall-nftables> router # [7812202.116317] router systemd[1]: Finished Permit User Sessions.
container-test-run-user-firewall-nftables> router # [7812202.116965] router systemd[1]: Started Console Getty.
container-test-run-user-firewall-nftables> router # [7812202.116994] router systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-user-firewall-nftables> router # [7812202.117016] router systemd[1]: Reached target Login Prompts.
container-test-run-user-firewall-nftables> router # [7812202.188630] router dbus-broker-launch[85]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-user-firewall-nftables> router # [7812202.189201] router dbus-broker-launch[85]: NSS returned no entry for 'systemd-timesync'
container-test-run-user-firewall-nftables> router # [7812202.189201] router dbus-broker-launch[85]: Invalid user-name in /nix/store/xjqr1rr6dvby76rk5bqpdpxpi2kcc01c-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-user-firewall-nftables> router # [7812202.189559] router systemd[1]: Started D-Bus System Message Bus.
container-test-run-user-firewall-nftables> router # [7812202.195344] router dbus-broker-launch[85]: Ready
container-test-run-user-firewall-nftables> router # [7812202.622098] router systemd-networkd[69]: eth1: Gained IPv6LL
container-test-run-user-firewall-nftables> router: (finished: waiting for unit multi-user.target, in 5.65 seconds)
container-test-run-user-firewall-nftables> router: waiting for TCP port 80 on localhost
container-test-run-user-firewall-nftables> router # [7812203.124576] router nginx-pre-start[114]: nginx: the configuration file /nix/store/0v75lyzd1xza7xgrwxmaakdh2509cqgb-nginx.conf syntax is ok
container-test-run-user-firewall-nftables> router # [7812203.124964] router nginx-pre-start[114]: nginx: configuration file /nix/store/0v75lyzd1xza7xgrwxmaakdh2509cqgb-nginx.conf test is successful
container-test-run-user-firewall-nftables> router # [7812203.128610] router systemd-logind[103]: New seat seat0.
container-test-run-user-firewall-nftables> router # [7812203.140255] router systemd[1]: Started Nginx Web Server.
container-test-run-user-firewall-nftables> router # [7812203.140579] router systemd[1]: Started User Login Management.
container-test-run-user-firewall-nftables> router # [7812203.141751] router systemd[1]: Starting linger-users.service...
container-test-run-user-firewall-nftables> router # [7812203.156525] router systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-user-firewall-nftables> router # [7812203.156670] router systemd[1]: Finished linger-users.service.
container-test-run-user-firewall-nftables> router # [7812203.157026] router systemd[1]: Reached target Multi-User System.
container-test-run-user-firewall-nftables> router # [7812203.157218] router systemd[1]: Startup finished in 5.201s.
container-test-run-user-firewall-nftables> Connection to localhost (::1) 80 port [tcp/http] succeeded!
container-test-run-user-firewall-nftables> router: (finished: waiting for TCP port 80 on localhost, in 4.03 seconds)
container-test-run-user-firewall-nftables> machine: waiting for unit multi-user.target
container-test-run-user-firewall-nftables> machine: (finished: waiting for unit multi-user.target, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: waiting for unit nginx.service
container-test-run-user-firewall-nftables> machine: (finished: waiting for unit nginx.service, in 0.01 seconds)
container-test-run-user-firewall-nftables> router: must succeed: ip -4 addr show eth1 | grep -oP '(?<=inet\s)\d+(\.\d+){3}'
container-test-run-user-firewall-nftables> router: (finished: must succeed: ip -4 addr show eth1 | grep -oP '(?<=inet\s)\d+(\.\d+){3}', in 0.01 seconds)
container-test-run-user-firewall-nftables> router: must succeed: ip -6 addr show eth1 | grep -oP '(?<=inet6\s)[0-9a-f:]+' | grep -v '^fe80' | head -1
container-test-run-user-firewall-nftables> router: (finished: must succeed: ip -6 addr show eth1 | grep -oP '(?<=inet6\s)[0-9a-f:]+' | grep -v '^fe80' | head -1, in 0.01 seconds)
container-test-run-user-firewall-nftables> Router IPv4: 192.168.1.2
container-test-run-user-firewall-nftables> Router IPv6: 2001:db8:1::2
container-test-run-user-firewall-nftables> machine: must succeed: systemctl restart nftables
container-test-run-user-firewall-nftables> machine: (finished: must succeed: systemctl restart nftables, in 0.15 seconds)
container-test-run-user-firewall-nftables> machine: waiting for unit nftables.service
container-test-run-user-firewall-nftables> machine: (finished: waiting for unit nftables.service, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: nft list table inet user-firewall >&2
container-test-run-user-firewall-nftables> table inet user-firewall {
container-test-run-user-firewall-nftables> 	chain output {
container-test-run-user-firewall-nftables> 		type filter hook output priority filter; policy accept;
container-test-run-user-firewall-nftables> 		oifname "lo" counter packets 0 bytes 0 accept comment "allow lo"
container-test-run-user-firewall-nftables> 		oifname "tun*" counter packets 0 bytes 0 accept comment "allow tun*"
container-test-run-user-firewall-nftables> 		oifname "tap*" counter packets 0 bytes 0 accept comment "allow tap*"
container-test-run-user-firewall-nftables> 		oifname "wg*" counter packets 0 bytes 0 accept comment "allow wg*"
container-test-run-user-firewall-nftables> 		oifname "tailscale*" counter packets 0 bytes 0 accept comment "allow tailscale*"
container-test-run-user-firewall-nftables> 		oifname "zt*" counter packets 0 bytes 0 accept comment "allow zt*"
container-test-run-user-firewall-nftables> 		oifname "vpn*" counter packets 0 bytes 0 accept comment "allow vpn*"
container-test-run-user-firewall-nftables> 		oifname "ipsec*" counter packets 0 bytes 0 accept comment "allow ipsec*"
container-test-run-user-firewall-nftables> 		oifname "nebula*" counter packets 0 bytes 0 accept comment "allow nebula*"
container-test-run-user-firewall-nftables> 		oifname "tinc*" counter packets 0 bytes 0 accept comment "allow tinc*"
container-test-run-user-firewall-nftables> 		oifname "edge*" counter packets 0 bytes 0 accept comment "allow edge*"
container-test-run-user-firewall-nftables> 		oifname "hyprspace" counter packets 0 bytes 0 accept comment "allow hyprspace"
container-test-run-user-firewall-nftables> 		oifname "ham0" counter packets 0 bytes 0 accept comment "allow ham0"
container-test-run-user-firewall-nftables> 		oifname "easytier" counter packets 0 bytes 0 accept comment "allow easytier"
container-test-run-user-firewall-nftables> 		oifname "mycelium" counter packets 0 bytes 0 accept comment "allow mycelium"
container-test-run-user-firewall-nftables> 		meta skuid 1002 counter packets 0 bytes 0 reject comment "blocked user bob"
container-test-run-user-firewall-nftables> 	}
container-test-run-user-firewall-nftables> }
container-test-run-user-firewall-nftables> machine: (finished: must succeed: nft list table inet user-firewall >&2, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: waiting for success: runuser -u alice -- curl -s http://127.0.0.1:8080
container-test-run-user-firewall-nftables> machine: (finished: waiting for success: runuser -u alice -- curl -s http://127.0.0.1:8080, in 0.02 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u alice -- curl -s http://192.168.1.2
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u alice -- curl -s http://192.168.1.2, in 0.02 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u alice -- curl -s http://[2001:db8:1::2]
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u alice -- curl -s http://[2001:db8:1::2], in 0.02 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u bob -- curl -s http://127.0.0.1:8080
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u bob -- curl -s http://127.0.0.1:8080, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u bob -- curl -s --connect-timeout 2 http://192.168.1.2 2>&1 || echo 'EXIT_CODE='$?
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u bob -- curl -s --connect-timeout 2 http://192.168.1.2 2>&1 || echo 'EXIT_CODE='$?, in 0.02 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u bob -- curl -s --connect-timeout 2 http://[2001:db8:1::2] 2>&1 || echo 'EXIT_CODE='$?
container-test-run-user-firewall-nftables> machine # [7812207.287225] machine systemd[1]: Stopping nftables firewall...
container-test-run-user-firewall-nftables> machine # [7812207.347640] machine systemd[1]: nftables.service: Deactivated successfully.
container-test-run-user-firewall-nftables> machine # [7812207.347801] machine systemd[1]: Stopped nftables firewall.
container-test-run-user-firewall-nftables> machine # [7812207.348848] machine systemd[1]: Starting nftables firewall...
container-test-run-user-firewall-nftables> machine # [7812207.432157] machine systemd[1]: Finished nftables firewall.
container-test-run-user-firewall-nftables> machine # [7812207.453435] machine runuser[225]: pam_unix(runuser:session): session opened for user alice(uid=1001) by (uid=0)
container-test-run-user-firewall-nftables> machine # [7812207.461754] machine runuser[225]: pam_unix(runuser:session): session closed for user alice
container-test-run-user-firewall-nftables> machine # [7812207.468940] machine runuser[227]: pam_unix(runuser:session): session opened for user alice(uid=1001) by (uid=0)
container-test-run-user-firewall-nftables> machine # [7812207.477189] machine runuser[227]: pam_unix(runuser:session): session closed for user alice
container-test-run-user-firewall-nftables> machine # [7812207.484996] machine runuser[229]: pam_unix(runuser:session): session opened for user alice(uid=1001) by (uid=0)
container-test-run-user-firewall-nftables> machine # [7812207.496991] machine runuser[229]: pam_unix(runuser:session): session closed for user alice
container-test-run-user-firewall-nftables> machine # [7812207.504891] machine runuser[231]: pam_unix(runuser:session): session opened for user bob(uid=1002) by (uid=0)
container-test-run-user-firewall-nftables> machine # [7812207.511519] machine runuser[231]: pam_unix(runuser:session): session closed for user bob
container-test-run-user-firewall-nftables> machine # [7812207.521551] machine runuser[234]: pam_unix(runuser:session): session opened for user bob(uid=1002) by (uid=0)
container-test-run-user-firewall-nftables> machine # [7812207.529843] machine runuser[234]: pam_unix(runuser:session): session closed for user bob
container-test-run-user-firewall-nftables> machine # [7812207.536975] machine runuser[237]: pam_unix(runuser:session): session opened for user bob(uid=1002) by (uid=0)
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u bob -- curl -s --connect-timeout 2 http://[2001:db8:1::2] 2>&1 || echo 'EXIT_CODE='$?, in 1.05 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: nft list table inet user-firewall
container-test-run-user-firewall-nftables> machine: (finished: must succeed: nft list table inet user-firewall, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: waiting for unit setup-wg0-interface.service
container-test-run-user-firewall-nftables> machine: (finished: waiting for unit setup-wg0-interface.service, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: waiting for unit nginx.service
container-test-run-user-firewall-nftables> machine: (finished: waiting for unit nginx.service, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: waiting for TCP port 8081 on 10.100.0.2
container-test-run-user-firewall-nftables> Connection to 10.100.0.2 8081 port [tcp/sunproxyadmin] succeeded!
container-test-run-user-firewall-nftables> machine: (finished: waiting for TCP port 8081 on 10.100.0.2, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: ip link show wg0
container-test-run-user-firewall-nftables> machine: (finished: must succeed: ip link show wg0, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: ip addr show wg0
container-test-run-user-firewall-nftables> machine: (finished: must succeed: ip addr show wg0, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u alice -- curl -s --interface wg0 http://10.100.0.2:8081/
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u alice -- curl -s --interface wg0 http://10.100.0.2:8081/, in 0.02 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u alice -- curl -s --interface wg0 http://[fd00::2]:8081/
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u alice -- curl -s --interface wg0 http://[fd00::2]:8081/, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u bob -- curl -s --interface wg0 http://10.100.0.2:8081/
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u bob -- curl -s --interface wg0 http://10.100.0.2:8081/, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u bob -- curl -s --interface wg0 http://[fd00::2]:8081/
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u bob -- curl -s --interface wg0 http://[fd00::2]:8081/, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: nft list table inet user-firewall | grep -E 'oifname.*wg' >&2
container-test-run-user-firewall-nftables> 		oifname "wg*" counter packets 0 bytes 0 accept comment "allow wg*"
container-test-run-user-firewall-nftables> machine: (finished: must succeed: nft list table inet user-firewall | grep -E 'oifname.*wg' >&2, in 0.01 seconds)
container-test-run-user-firewall-nftables> (finished: run the VM test script, in 11.10 seconds)
container-test-run-user-firewall-nftables> machine # [7812208.575420] machine runuser[237]: pam_unix(runuser:session): session closed for user bob
container-test-run-user-firewall-nftables> machine # [7812208.626149] machine runuser[245]: pam_unix(runuser:session): session opened for user alice(uid=1001) by (uid=0)
container-test-run-user-firewall-nftables> machine # [7812208.636735] machine runuser[245]: pam_unix(runuser:session): session closed for user alice
container-test-run-user-firewall-nftables> machine # [7812208.641697] machine runuser[247]: pam_unix(runuser:session): session opened for user alice(uid=1001) by (uid=0)
container-test-run-user-firewall-nftables> machine # [7812208.647028] machine runuser[247]: pam_unix(runuser:session): session closed for user alice
container-test-run-user-firewall-nftables> machine # [7812208.652046] machine runuser[249]: pam_unix(runuser:session): session opened for user bob(uid=1002) by (uid=0)
container-test-run-user-firewall-nftables> machine # [7812208.657635] machine runuser[249]: pam_unix(runuser:session): session closed for user bob
container-test-run-user-firewall-nftables> machine # [7812208.662979] machine runuser[251]: pam_unix(runuser:session): session opened for user bob(uid=1002) by (uid=0)
container-test-run-user-firewall-nftables> machine # [7812208.671422] machine runuser[251]: pam_unix(runuser:session): session closed for user bob
container-test-run-user-firewall-nftables> test script finished in 14.19s
container-test-run-user-firewall-nftables> cleanup
container-test-run-user-firewall-nftables> kill NspawnMachine (pid 52)
container-test-run-user-firewall-nftables> kill NspawnMachine (pid 53)
container-test-run-user-firewall-nftables> Container machine terminated by signal KILL.
container-test-run-user-firewall-nftables> Container router terminated by signal KILL.
container-test-run-user-firewall-nftables> (finished: cleanup, in 0.18 seconds)

post-build step Upload to niks3: ok
time=2026-08-29T20:04:29.824Z level=INFO msg="Uploading 0 paths to niks3.clan.lol (1 already cached)"
time=2026-08-29T20:04:35.726Z level=INFO msg="Uploading 1 narinfos"
time=2026-08-29T20:04:35.956Z level=INFO msg="Upload complete. (6.256s)"