# `Hyper.SuidHelper.Network`
[🔗](https://github.com/harmont-dev/hyper/blob/main/lib/hyper/suid_helper/network.ex#L1)

Privileged per-VM egress networking via the setuid helper's `network`
subcommands. The helper derives every address, interface name, and netns path
from `vm_id` + the validated `uid` + the root-owned `[network]` config — the
node passes only those two untrusted values.

# `err`

```elixir
@type err() :: Hyper.SuidHelper.err()
```

# `host_init`

```elixir
@spec host_init() :: :ok | {:error, err()}
```

Ensure the host-wide `hyper` nft table (masquerade + forward policy) exists. Idempotent.

# `prepare`

```elixir
@spec prepare(Hyper.Vm.Id.t(), non_neg_integer()) :: :ok | {:error, err()}
```

Create `vm_id`'s netns, veth pair, TAP, and NAT rules. Idempotent-safe on relaunch.

# `teardown`

```elixir
@spec teardown(Hyper.Vm.Id.t(), non_neg_integer()) :: :ok | {:error, err()}
```

Remove `vm_id`'s netns and host veth. Idempotent (a never-prepared VM is a no-op).

# `teardown_orphan`

```elixir
@spec teardown_orphan(Hyper.Vm.Id.t()) :: :ok | {:error, err()}
```

Remove `vm_id`'s netns by id alone, with no `uid` — for the `Reaper`'s
crashed-node backstop, where the owning node never persisted a uid to derive
the clone-pool slot from. Idempotent: a netns already gone (raced with a
normal `teardown/2`, or never fully created) is not an error.

---

*Consult [api-reference.md](api-reference.md) for complete listing*