iptables -t raw -D ISTIO_OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j CT --zone 1
ip6tables -t raw -D ISTIO_OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j CT --zone 1
iptables -t raw -D ISTIO_OUTPUT -p udp --sport 15053 -m owner --gid-owner 1 -j CT --zone 2
ip6tables -t raw -D ISTIO_OUTPUT -p udp --sport 15053 -m owner --gid-owner 1 -j CT --zone 2
iptables -t raw -D ISTIO_OUTPUT -p udp --dport 53 -m owner --gid-owner 2 -j CT --zone 1

iptables -t nat -A ISTIO_OUTPUT -o lo -m owner ! --gid-owner 1 -j RETURN
iptables -t nat -A ISTIO_OUTPUT -m owner --gid-owner 1 -j RETURN
iptables -t nat -A ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 2 -j ISTIO_IN_REDIRECT
iptables -t nat -A ISTIO_OUTPUT -o lo -m owner ! --gid-owner 2 -j RETURN

iptables -t nat -A ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 1 -j ISTIO_IN_REDIRECT
iptables -t nat -A ISTIO_OUTPUT -o lo -p tcp ! --dport 53 -m owner ! --gid-owner 1 -j RETURN
iptables -t nat -A ISTIO_OUTPUT -m owner --gid-owner 1 -j RETURN
iptables -t nat -A ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 2 -j ISTIO_IN_REDIRECT

iptables -t nat -A ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 1 -j ISTIO_IN_REDIRECT
iptables -t nat -A ISTIO_OUTPUT -o lo -p tcp ! --dport 53 -m owner ! --gid-owner 1 -j RETURN
iptables -t nat -A ISTIO_OUTPUT -m owner --gid-owner 1 -j RETURN
iptables -t nat -A ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 2 -j ISTIO_IN_REDIRECT

	if err := runEtcdAsNonRoot(&pod, &runAsUser, &runAsGroup, func(path string, uid, gid int64, perms uint32) error {
		updatedFiles[path] = ownerAndPermissions{uid: uid, gid: gid, permissions: perms}
		return nil
	},
		func(path string, uid, gid int64) error {
			updatedFiles[path] = ownerAndPermissions{uid: uid, gid: gid, permissions: 0700}
			return nil
		}, cfg); err != nil {
		t.Fatal(err)
	}

iptables -t nat -A ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT
iptables -t nat -A ISTIO_OUTPUT -o lo -p tcp ! --dport 53 -m owner ! --gid-owner 1337 -j RETURN
iptables -t nat -A ISTIO_OUTPUT -m owner --gid-owner 1337 -j RETURN
iptables -t nat -A ISTIO_OUTPUT -m owner ! --gid-owner java -m owner ! --gid-owner 202 -j RETURN
iptables -t nat -A ISTIO_OUTPUT -d 127.0.0.1/32 -j RETURN

func checkUidGid(t *testing.T, path string, uid, gid int) {
	dir, err := Lstat(path)
	if err != nil {
		t.Fatalf("Lstat %q (looking for uid/gid %d/%d): %s", path, uid, gid, err)
	}
	sys := dir.Sys().(*syscall.Stat_t)
	if int(sys.Uid) != uid {
		t.Errorf("Lstat %q: uid %d want %d", path, sys.Uid, uid)
	}
	if int(sys.Gid) != gid {
		t.Errorf("Lstat %q: gid %d want %d", path, sys.Gid, gid)
	}
}

func TestChown(t *testing.T) {

	}
	primaryGid, err := strconv.Atoi(u.Gid)
	if err != nil {
		return nil, fmt.Errorf("user: list groups for %s: invalid gid %q", u.Username, u.Gid)
	}

	userCommas := []byte("," + u.Username + ",")  // ,john,
	userFirst := userCommas[1:]                   // john,
	userLast := userCommas[:len(userCommas)-1]    // ,john
	userOnly := userCommas[1 : len(userCommas)-1] // john

	// Add primary Gid first.
	groups := []string{u.Gid}

    }

    /**
     * Generate a stable GID based on the class name and hash of some object info.
     *
     * GIDs generated this way will be in the form of
     * {@code <class-name-hash-32> <obj-hash-32> <counter-32>}
     */
    public String generateGid(String pbxClassName, int hash) {
        int counter = 0;
        String gid;
        do {

	{in: testGroupFile, user: "user777", gid: "7", gids: []string{"7", "777", "1000"}},
	{in: testGroupFile, user: "user1111", gid: "1111", gids: []string{"1111", "1000"}},
	{in: testGroupFile, user: "user1000", gid: "1000", gids: []string{"1000"}},
	{in: testGroupFile, user: "user7500", gid: "7500", gids: []string{"1000", "7500"}},
	{in: testGroupFile, user: "no-such-user", gid: "2345", gids: []string{"2345"}},