[Feature Request]: Enable `CONFIG_IP_MULTIPLE_TABLES` and `CONFIG_TUN` in guest kernel

[seanchann]

Summary

Currently, running networking tools, container VPNs, or proxy clients (such as sing-box, tailscale, or custom policy routing scripts) inside the guest sandbox fails because the minimal microvm kernel lacks policy routing (FIB rules) and TUN/TAP support.

Executing ip rule list or setting up custom routing tables inside the guest returns RTNETLINK answers: Operation not supported.

Steps to Reproduce

• Start any standard container (e.g., ubuntu:24.04) in a sandbox:

msb run -i ubuntu:latest -d

• Execute into the sandbox shell:

msb exec <sandbox-name> -- bash
Test policy routing and tun device creation:

ip rule list
# Output: RTNETLINK answers: Operation not supported

ip tuntap add mode tun dev tun0

Actual Behavior

ip rule list fails with RTNETLINK answers: Operation not supported.

Network utilities calling RTM_GETRULE / RTM_NEWRULE via Netlink fail immediately (e.g., cleanup rules: list rules: operation not supported in sing-box).

Expected Behavior

Standard Linux policy routing (ip rule) should be supported so that multi-table routing and transparent proxy/VPN software can run inside developer sandboxes.

Proposed Solution / Kernel Configuration
Please consider enabling the following kernel configuration flags in the guest kernel build:

Ini, TOML

Enable advanced IP routing & multiple routing tables

CONFIG_IP_ADVANCED_ROUTER=y
CONFIG_IP_MULTIPLE_TABLES=y
CONFIG_IP_ROUTE_MULTIPATH=y
CONFIG_IPV6_MULTIPLE_TABLES=y

Enable TUN/TAP driver (builtin)

CONFIG_TUN=y
Context & Impact
Binary Overhead: Enabling these options has negligible impact on kernel image size (< 50 KB) and cold-boot time.

Developer Workflow: Unlocks crucial network isolation, transparent proxies, and developer VPN toolchains inside microsandbox environments.