fix(embed): fall back to iptables-legacy when nft backend is unsupported

[thejoeejoee]

Summary

• Entrypoint now probes iptables (nft) first, falls back to iptables-legacy, and hard-aborts if neither works
• Fixes container startup on Rancher Desktop with VZ virtualization (no Rosetta) where the kernel lacks CONFIG_NF_TABLES
• Network isolation is never silently skipped

Root cause

Ubuntu 24.04's iptables package defaults to the nftables backend (iptables-nft). Rancher Desktop's VZ virtualization runs a minimal ARM64 Linux kernel without nf_tables kernel module support → iptables: Failed to initialize nft: Protocol not supported.

Both iptables-nft and iptables-legacy ship in the same Ubuntu package and provide identical rule semantics — only the kernel backend differs.

[Copilot]

Pull request overview

This PR updates the embedded container entrypoint to reliably enforce outbound network isolation across environments where the default iptables backend (nft) may be unsupported (e.g., kernels without nf_tables).

Changes:

• Add a startup probe to select a working iptables implementation (iptables first, then iptables-legacy).
• Abort container startup if no functional iptables implementation is available (to avoid silently skipping isolation).
• Route all subsequent firewall rule insertions/appends through the selected iptables variant.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.