Match the execution boundary
Distinguish native Linux, containers, VMs and remote hosts. Record effective users, namespaces, firewall manager ownership, service sockets and privileged delegates. A user socket match does not automatically cover a changed identity, shared resolver or forwarded traffic.
Review output, forwarding, NAT, TUN and established-connection behavior. Never flush the machine’s rules as a shortcut. Keep the proxy and maintenance identities outside the protected workload denial.
Delegation and recovery
An unrestricted container socket, privileged helper or host delegate can escape the intended boundary. Package managers under another identity require separate handling. Verify every actual execution location.
Use the installed manager’s scoped transaction and a tested recovery plan. Unknown delegation or startup paths remain explicit gaps; this page provides no universal shell commands.