Network Sandbox Engine v2 - testing nftables rules in a real kernel environment, risk-free

Question

I built NSE (Network Sandbox Engine) because testing nftables rules on a live system is dangerous. One bad rule can leave orphan tables behind.

NSE solves this by creating an ephemeral Linux network namespace, loading your ruleset, injecting synthetic packets, and capturing kernel verdicts via nft monitor trace. The host firewall never gets touched.

What's new in v2.0.0:

• In-process architecture - removed the rootd socket daemon. Everything runs in a single process.
• Pydantic core - all data models are strongly typed. The entire codebase passes mypy --strict.
• Deterministic trace harvesting - no more hardcoded sleep delays. NSE waits for kernel traces to be ready and returns real verdicts (ACCEPT/DROP/REJECT).
• Automated cleanup - startup sweeps orphaned namespaces. Teardown uses exponential backoff retries.
• Gateway topologies - support for router + server namespaces to test NAT and forwarding rules.
• MkDocs documentation with mkdocstrings for API reference.
• import-linter enforces architectural boundaries between core and GUI.

How to use it:

• As a Python library - import nse and write packet-level tests.
• As a CLI for CI/CD - write YAML test definitions and run nse-runner.
• With the web UI - FastAPI backend + Svelte frontend for real-time packet tracing and conntrack visualization.

Requirements: Linux (kernel 5.4+), Python 3.10+, nftables, iproute2, root privileges.

Links:

• Repo: https://github.com/onyks-os/NetworkSandboxEngine
• Docs: https://onyks-os.github.io/nse/
• Changelog: https://github.com/onyks-os/NetworkSandboxEngine/blob/main/CHANGELOG.md

I'm looking for feedback. What would make this useful for your workflow? What's missing?