Hello,
I maintain Ella Core, a 4G and 5G private cellulare core. I maintain both the upstream and the snap.
Being an eBPF-based private cellular network, it requires a lot of connections. The project is open source and you can inspect exactly how and why we need each of these.
Manually connecting each of them makes the installation process tedious. I wish it was one command. It’s quite obvious that a cellular network will need to connect to the network.
sudo snap install ella-core
sudo snap connect ella-core:network-control
sudo snap connect ella-core:process-control
sudo snap connect ella-core:firewall-control
sudo snap connect ella-core:mount-observe
Request
name: ella-core
description: 4G and 5G mobile core network for private deployments
snapcraft: https://github.com/ellanetworks/core/blob/main/snap/snapcraft.yaml
upstream: https://github.com/ellanetworks/core
upstream-relation: maintainer
plugs:
network-control:
request-type: auto-connection
reasoning: the datapath loads eBPF programs (bpf syscall) and attaches
them to network interfaces, creates veth pairs, manages
routes and neighbour entries over netlink, binds sockets to VRF devices
(SO_BINDTODEVICE) and enables IPv4/IPv6 forwarding in /proc/sys/net.
Without it the bpf syscall is blocked and the daemon fails to start.
firewall-control:
request-type: auto-connection
reasoning: installs an nftables rule that drops kernel IP forwarding, so
user traffic is only forwarded by the eBPF datapath. Without it the
netfilter socket is blocked and route reconciliation fails.
process-control:
request-type: auto-connection
reasoning: raises RLIMIT_MEMLOCK to unlimited (CAP_SYS_RESOURCE), required
to load eBPF maps and programs on kernels that account BPF memory to
memlock. Without it the daemon fails to start.
mount-observe:
request-type: auto-connection
reasoning: the eBPF loader (cilium/ebpf) reads /proc/self/mountinfo to probe
for BPF token support before loading the eBPF programs. Without it the
daemon fails to start.