Let non-root validators lock flights down, and alert when they cannotThe image granted the firewall capability to the legacy iptables binary whileiptables runs the nft one, so every lockdown failed and the host left scoringwithout a sign. The grant now follows the binary iptables resolves to and thebuild fails without it. The lockdown log carries the firewall's error, thevalidator re-checks the permission every minute with a critical alert, anexcluded host raises its own critical alert, CI locks a container downthrough the image as a plain uid, the deploy script reads paths and ids from.env before its defaults, and a docker run that timed out keeps removing itscontainer.