Рефакторинг под прод: nsenter-first транспорт, drift-aware reconcile, hardening daemon/lock/reboot/swap, расширенный status и build-скрипт

traffic_core/src/iface.rs

@@ -1,23 +1,34 @@
-use crate::{config::Config, docker::run_capture};
+use crate::{
+    config::Config,
+    netns::{DockerExecTransport, NsTransport, NsenterTransport, nsenter_available},
+};
 
-pub fn detect_interface(cfg: &Config, container: &str) -> anyhow::Result<String> {
+pub fn detect_interface(cfg: &Config, pid: u32, container: &str) -> anyhow::Result<String> {
+    let boxed: Box<dyn NsTransport> = if nsenter_available() {
+        Box::new(NsenterTransport { pid })
+    } else {
+        Box::new(DockerExecTransport {
+            container: container.to_string(),
+        })
+    };
+
+    detect_interface_with_transport(cfg, boxed.as_ref())
+}
+
+pub fn detect_interface_with_transport(
+    cfg: &Config,
+    transport: &dyn NsTransport,
+) -> anyhow::Result<String> {
     for ifname in &cfg.amnezia.interface_candidates {
-        let ok = std::process::Command::new("docker")
-            .args(["exec", container, "ip", "link", "show", ifname])
-            .output()?;
-        if ok.status.success() {
+        if transport
+            .run(&["ip", "link", "show", ifname])
+            .is_ok()
+        {
             return Ok(ifname.clone());
         }
     }
 
-    let links = run_capture(&[
-        "docker",
-        "exec",
-        container,
-        "sh",
-        "-c",
-        "ip -o link show | awk -F': ' '{print $2}'",
-    ])?;
+    let links = transport.run(&["sh", "-c", "ip -o link show | awk -F': ' '{print $2}'"])?;
 
     for raw in links.lines() {
         let name = raw.trim();