feat: enforce isolation between WonderNets with empty ACL policy

.github/workflows/e2e.yaml

@@ -46,3 +46,47 @@ jobs:
           docker logs worker-2 2>&1 | tail -50 || true
           echo "=== Worker 3 logs ==="
           docker logs worker-3 2>&1 | tail -50 || true
+
+  e2e-isolation:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.23'
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Load TUN module
+        run: |
+          sudo modprobe tun
+          ls -la /dev/net/tun
+
+      - name: Run E2E isolation tests
+        working-directory: e2e
+        run: ./test-isolation.sh
+
+      - name: Show logs on failure
+        if: failure()
+        working-directory: e2e
+        run: |
+          echo "=== Coordinator logs ==="
+          docker logs coordinator 2>&1 | tail -100 || true
+          echo "=== Keycloak logs ==="
+          docker logs keycloak 2>&1 | tail -50 || true
+          echo "=== Worker 1 logs ==="
+          docker logs worker-1 2>&1 | tail -50 || true
+          echo "=== Worker 2 logs ==="
+          docker logs worker-2 2>&1 | tail -50 || true
+          echo "=== Worker 3 logs ==="
+          docker logs worker-3 2>&1 | tail -50 || true
+          echo "=== Worker 4 logs ==="
+          docker logs worker-4 2>&1 | tail -50 || true
+          echo "=== Worker 5 logs ==="
+          docker logs worker-5 2>&1 | tail -50 || true

e2e/docker-compose.yaml

@@ -92,6 +92,30 @@ services:
     depends_on:
       - nginx
 
+  worker-4:
+    build:
+      context: .
+      dockerfile: Dockerfile.worker
+    container_name: worker-4
+    hostname: worker-4
+    privileged: true
+    volumes:
+      - /dev/net/tun:/dev/net/tun
+    depends_on:
+      - nginx
+
+  worker-5:
+    build:
+      context: .
+      dockerfile: Dockerfile.worker
+    container_name: worker-5
+    hostname: worker-5
+    privileged: true
+    volumes:
+      - /dev/net/tun:/dev/net/tun
+    depends_on:
+      - nginx
+
   deployer:
     build:
       context: .

e2e/keycloak-realm.json

@@ -40,6 +40,21 @@
           "temporary": false
         }
       ]
+    },
+    {
+      "username": "testuser2",
+      "enabled": true,
+      "emailVerified": true,
+      "email": "testuser2@example.com",
+      "firstName": "Test",
+      "lastName": "User2",
+      "credentials": [
+        {
+          "type": "password",
+          "value": "testpass2",
+          "temporary": false
+        }
+      ]
     }
   ]
 }