You definitely identified the right spot where the error is coming from. What I can tell you from reading that code is that guardian tried running iptables and got an error, likely iptables returned exit 1. That buff var should contain any stdout/stderr from iptables, but there's nothing. Not sure what kind of restrictions you have going on as I'm not familiar with nixos, but maybe guardian couldn't even start iptables?

Anyways, I'd recommend trying the containerd runtime as we have much more control over that one within the Concourse project.