Currently, iocaine uses libnftables1-sys, a thin crate that wraps the libfntables C library. It does so because when I was writing the firewall support, there were two other options: nftnl and a vibe-coded thing. Both of them lacked support for working with sets the way I wanted to, so libnftables1-sys was the "straightforward" option.

It's... not great. It is driven by passing it string commands, which it parses and then does the netlink stuff behind the scenes. It also inherits all of the weird implementation details of libnftables.

Yesterday, I was made aware of nft-set-elem, which in itself, is not complete enough for iocaine's use case, but... it appears to be not slop, and its code is clear enough for me to build on, and extend to support the things iocaine needs.