container 1.5.0: supported integration for exclusive, fail-closed guest networking?

[bmeyer]

Use case

Hi, I am assessing container 1.5.0 on Apple Silicon/macOS 26 for untrusted
build workloads. I need default-deny networking enforced outside the guest:
only explicitly allowed service endpoints should be reachable, not host
management, the private LAN or unrelated guests. This must cover IPv4/IPv6
and remain restrictive if the enforcement component stops, crashes or is
disabled. Stopping a VM after detecting filter loss is not sufficient as
the sole boundary because of the detection interval.

This is an integration question, not a vulnerability report. My assessment
so far is source-based; I have not booted guests or run filter-failure tests
for this setup.

What I found

The 1.5.0 dependency lock
pins Containerization 0.47.0. The released
runtime strategy table
registers vmnet allocationOnly/reserved strategies. My reading is that
a network helper alone cannot select a different attachment without a
matching runtime strategy. Please correct me if I have missed an extension point.

I also found open PRs Containerization #759,
#935 and
container #1622
(unmerged when checked on 2026-10-02). The Containerization proposal adds a
FileHandle interface; the container proposal adds runtime/bridge integration. Its
strategy at the inspected revision
selects a direct bridge when the socket endpoint is absent. That makes sense
for its bridging use case, but would not meet an exclusive-enforcement requirement.

Questions

1. Is there a supported integration for 1.5.0 that routes all guest network
   frames exclusively through host-side enforcement, with no direct
   vmnet/NAT/bridge bypass? Can it use VZFileHandleNetworkDeviceAttachment
   without a runtime fork or private XPC dependency?
2. If not, are these PRs the intended direction, and could an exclusive mode
   reject a missing broker endpoint instead of selecting a direct bridge?
   Which runtime/strategy interfaces are intended for external integrations
   and compatibility across updates?
3. For the recommended approach (including PF/Network Extension if applicable),
   is there documentation or a test describing guest-to-host/inter-guest
   packet coverage and behavior on enforcement loss, including established
   connections, queued frames and Layer 2 traffic?

Pointers to an existing implementation or relevant documentation would be
very helpful. A clarification that this is not currently supported would
also help me plan. I would review vsock/filesystem channels separately.
Thank you!