# AI sandbox firewall — re-armed after every boot.
#
# The alpha-ai docker network survives a reboot; the iptables rules that make
# it a SANDBOX do not. Without this line the box comes back with AI containers
# on a bridge that can reach MariaDB, the LXD bridge and every other private
# network — the exact thing the sandbox exists to prevent, failing silently.
#
# The sleep-and-retry is because DOCKER-USER only exists once dockerd is up,
# and cron's @reboot fires before docker has finished starting.
@reboot root for i in 1 2 3 4 5 6; do sleep 20; /usr/local/sbin/alpha-aisandbox ensure >/dev/null 2>&1 && break; done
