FEATURE: Add [egress].mode (dns | dns+nft, default dns); wire to sidecar as OPENSANDBOX_EGRESS_MODE on both Docker and Kubernetes.

[Pangjiping]

Summary

• Egress config: Add [egress].mode (dns | dns+nft, default dns); wire to sidecar as OPENSANDBOX_EGRESS_MODE on both Docker and Kubernetes.
• Constants: Centralize EGRESS_RULES_ENV, EGRESS_MODE_ENV, and OPENSANDBOX_EGRESS_TOKEN in server/src/services/constants.py.
• Kubernetes egress: Run the sidecar privileged; use a startup command (sysctl for net.ipv6.conf.all.disable_ipv6, then /egress) instead of Pod securityContext.sysctls for IPv6; remove build_ipv6_disable_sysctls.
• Types & docs: egress_mode is a non-optional str with default EGRESS_MODE_DNS; README updated (incl. CIDR rules only for dns+nft).

Testing

• Not run (explain why)
• Unit tests
• Integration tests
• e2e / manual verification

Breaking Changes

• None
• Yes (describe impact and migration path)

Checklist

• Linked Issue or clearly described motivation
• Added/updated docs (if needed)
• Added/updated tests (if needed)
• Security impact considered
• Backward compatibility considered

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2a3061316a

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[ninan-nn]

LGTM

[Pangjiping]

Events:
  Type     Reason           Age   From               Message
  ----     ------           ----  ----               -------
  Normal   Scheduled        16s   default-scheduler  Successfully assigned opensandbox/4b6e8a84-04f8-4e4b-b1e2-76b8d47a74c8-0 to k8s-worker-002
  Warning  SysctlForbidden  17s   kubelet            forbidden sysctl: "net.ipv6.conf.all.disable_ipv6" not allowlisted