{
 "held": [
  "netns",
  "unit_ip_filter"
 ],
 "netns": {
  "mode": "netns (inner.py's own probe inside units.bwrap_argv's sandbox, before any engine)",
  "verdict": "enforced",
  "why": "only lo; DNS fails; the canary connect fails; loopback answers"
 },
 "unit": {
  "IPAddressAllow": "127.0.0.0/8 ::1/128",
  "IPAddressDeny": "::/0 0.0.0.0/0",
  "KillMode": "control-group",
  "MemoryMax": "85899345920",
  "User": "an operator",
  "unit": "desktop-w1-row.service"
 },
 "unit_ip_filter": {
  "mode": "ipfilter (inner.py's own probe, probe_only, in this unit outside the sandbox: a connect to the box's own non-loopback address must be dropped)",
  "outside_connect": "failed (ETIMEDOUT: dropped)",
  "rc": 0,
  "verdict": "enforced",
  "why": "a connect to the box's own non-loopback address is dropped (the IP filter is enforced); loopback answers"
 }
}