I’ve got rootless Podman containers with dedicated network namespace.
Need to block internet access on some of them. I’m setting up nftables in Podman rootless namespace.

This what I’ve tried:

    table ip filter {
...
        chain output {
                type filter hook output priority filter; policy accept;
                socket cgroupv2 level 5 "user.slice/user-1001.slice/[email protected]/nomad.slice/libpod-987157aff0dfe097a3fd90f09bd665fff553740c83856d961644224f0f81804d.scope" drop
        }
}

The path is correct. Tried setting the chain policy to ‘drop’ which works meaning the packets are traversing this chain. But for some reason cgroup specific rule is ignored. Also tried adding a counter for the same rule and it stays 0.
I could be misunderstanding how this works.
What would be the proper way to debug this?