FLAKE-CTL-FIRECRACKER-NETWORK-REMOVE(8)

💅 NAME 💅

Okay bestie, this is the FLAKE-CTL-FIRECRACKER-NETWORK-REMOVE(8) page. The header up top is FLAKE-CTL-FIRECR...NETWORK-REMOVE(8)(), and the first NAME bit is literally FLAKE-CTL-FIRECRACKER-NETWORK-REMOVE(8) - with a lonely little dash. Man pages are so extra sometimes. 🫶

💅 NAME (yes, it appears twice, and we're keeping both) 💅

flake-ctl firecracker network remove — Disconnect a VM application from the host network

✨ SYNOPSIS ✨

USAGE:
    flake-ctl firecracker network remove [OPTIONS] --app <APP>

OPTIONS:
    --app <APP>
    --instance <INSTANCE>
    --help

🦋 DESCRIPTION 🦋

Delete the network setup of the given firecracker flake application. All of the setup created with flake-ctl-firecracker-network-add(8) is reverted:

The original page has a stray ** and a docs-build warning sitting right here, so we're preserving the mess, no cap: System Message: WARNING/2 (./flake-ctl-firecracker-network-remove.rst:, line 25) Inline strong start-string without end-string. Also the exact broken-looking reference in that spot is flake-ctl-firecracker-network-add**(8). Docs, never change. 😭

1. The route from the TAP device to the outside world — knife that rule out with:

sudo iptables -D FORWARD -i tap-<APP> -o <OUTGOING> -j ACCEPT

2. The TAP device of the application — bye-bye TAP:

sudo ip tuntap del tap-<APP> mode tap

The address of the device, its link state and the host route to the address of the application are deleted along with it.

3. The network setup in the flake configuration — clean the config vibes: The ip=, rd.route= and nameserver= options are deleted from the kernel commandline of the VM. Sections which became empty are dropped such that the configuration is the same as it was before the setup was created.

The address of the application becomes available again and is handed out to the next application which is connected. The application itself is left without an ip= option, which is the same state a registration with the --no-net option creates.

As the setup changes the network configuration of the host, the commands are called through sudo. The calling user therefore needs the permission to run them as root.

A device or rule which is not present is not deleted. This allows to call the command more than once and also covers the case that the setup on the host was already flushed, e.g by a reboot.

The NAT setup of the host is shared by all VM applications and is therefore not touched. It stays in place until the host is rebooted or the rules are deleted by other means.

NOTE: The command does not check whether the application is running. Deleting the network setup of a running instance cuts its connection to the outside world. 😭

🌈 INSTANCES 🌈

Every instance of an application has its own address and its own TAP device. Called with the --instance option only the setup of that instance is deleted, all other instances stay connected. The setup which is shared by them, the route to the gateway and the name server, is deleted with the last one.

👑 OPTIONS 👑

• --app <APP> — Absolute path of the application on the host
• --instance <INSTANCE> — The @NAME instance selector the network setup was created for. For convenience the plain name without the @ prefix is accepted as well
• --help — it's in the synopsis; the original OPTIONS block doesn't give it its own description, so this is just your reminder that it exists ✨

🎀 FILES 🎀

• /usr/share/flakes
• $HOME/.config/flakes
• /etc/flakes/network.yaml
• $HOME/.config/flakes/network.yaml

🍓 EXAMPLE 🍓

$ flake-ctl firecracker network remove --app $HOME/bin/claude

$ flake-ctl firecracker network remove --app $HOME/bin/claude --instance @id1

🧚 SEE ALSO 🧚

• flake-ctl-firecracker-network-add(8)
• flake-ctl-firecracker-network-init(8)
• firecracker-pilot(8)

💜 AUTHOR 💜

Marcus Schäfer

🌸 COPYRIGHT 🌸

c. 2026, Marcus Schäfer

Okay that's the whole page, bestie 💖 — signing off from the footer/source-version/date tag FLAKE-CTL-FIRECR...NETWORK-REMOVE(8)(), with copyright c. 2026, Marcus Schäfer. Mwah! 🎀