branderson
5294e72a32
init-firewall.sh's ipset population was a one-time snapshot at container start: an already-allowed domain could still start failing to connect later if its CDN edge rotated to an IP that was never added (pypi.org/files.pythonhosted.org/GitHub's release-assets CDN all do this), and allowing a domain like crates.io didn't help traffic that actually goes to a different hostname under it (index.crates.io/static.crates.io). dns-proxy.sh's dnsmasq now also uses --ipset= so the resolved IP gets added on every fresh answer it serves for the life of the session, not just once at boot - verified this actually repopulates after a real (non-cached) re-resolution, and that dnsmasq tolerates the target ipset not existing yet when its config is generated (it runs before init-firewall.sh creates it). Also batches log-shipper.sh's Loki pushes (up to 20 lines or 2s, whichever first) instead of one HTTP request per line - a burst of activity (e.g. npm install resolving/connecting to many hosts quickly) would otherwise spam Loki with one request per line. Verified via the sandbox's own connection logging: 15 rapid lines produced 2 requests instead of 15.