OpenWrt service / process manager https://git.openwrt.org/project/procd/atom?h=master 2026-10-07T14:29:53Z 2026-10-07T14:29:53Z Nick Hainke 2026-10-03T22:29:33Z urn:sha1:6a22d3964822f6d58fba4c4686e385ddb7e7fcb1 Add a 'vrf' instance attribute which binds all AF_INET/AF_INET6 sockets of a service to a Linux VRF device, like 'ip vrf exec <vrf>' does, without depending on iproute2, libbpf or libnl. Before executing the service, procd attaches a BPF_PROG_TYPE_CGROUP_SOCK program at BPF_CGROUP_INET_SOCK_CREATE to the cgroup of the instance, which sets sk_bound_dev_if of every new socket to the ifindex of the VRF. This is the mechanism iproute2 uses. The VRF is resolved with an RTM_GETLINK request, which also checks that the device is a VRF. Running the service outside of the VRF could expose it to, or let it talk to, the wrong network. The service is therefore not executed if the process can't be moved into the cgroup or the program can't be attached, and the instance is rejected if 'vrf' is combined with a bundle or a jail with its own or a joined network namespace, where the cgroup or the ifindex wouldn't match. The cgroup of an instance without a jail outlives the process, so a program attached by an earlier run is detached if the instance has no VRF anymore. The sockets are bound to the ifindex of the VRF. Like for 'netdev', restart the instance if the ifindex changed when the service is set again, e.g. after the VRF device was recreated. Assisted-by: Claude:claude-fable-5-1 Signed-off-by: Nick Hainke <vincent@systemli.org>