{"-t", iptablesconstants.MANGLE, "-D", iptablesconstants.OUTPUT, "-j", ChainInpodOutput},
		{"-t", iptablesconstants.NAT, "-D", iptablesconstants.OUTPUT, "-j", ChainInpodOutput},
	}

	// these sometimes fail due to "Device or resource busy"
	optionalDeleteCmds := [][]string{
		// flush-then-delete our created chains
		{"-t", iptablesconstants.MANGLE, "-F", ChainInpodPrerouting},
		{"-t", iptablesconstants.MANGLE, "-F", ChainInpodOutput},

func TestOpenNetns(t *testing.T) {
	ns, err := OpenNetns("/proc/self/ns/net")
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	// the inode for netns is proc dynamic, so it needs to be higher than
	// #define PROC_DYNAMIC_FIRST 0xF0000000U

	if ns.Inode() < 0xF0000000 {
		t.Fatalf("unexpected inode: %v", ns.Inode())
	}
	defer ns.Close()