imporve comments

Author: evgeniy-scherbina

jail/linux.go

@@ -159,9 +159,9 @@ func NewLinuxJail(config Config) (*LinuxJail, error) {
 }
 
 // ConfigureBeforeCommandExecution prepares the jail environment before the target
-// process is launched. It sets environment variables and performs host-side
-// networking setup (e.g., creating the veth pair). At this point the target
-// process has not started, so its PID and network namespace ID are unknown.
+// process is launched. It sets environment variables, creates the veth pair, and
+// installs iptables rules on the host. At this stage, the target PID and its netns
+// are not yet known.
 func (l *LinuxJail) ConfigureBeforeCommandExecution() error {
 	l.logger.Debug("Setup called")
 
@@ -198,9 +198,9 @@ func (l *LinuxJail) Command(command []string) *exec.Cmd {
 	return cmd
 }
 
-// ConfigureAfterCommandExecution finalizes networking after the target process starts.
-// With the child PID known, it moves the jail-side veth into the child’s netns
-// and installs iptables rules to redirect traffic through the proxy.
+// ConfigureAfterCommandExecution finalizes setup once the target process starts.
+// With the child PID known, it moves the jail-side veth into the child’s network
+// namespace.
 func (l *LinuxJail) ConfigureAfterCommandExecution(pidInt int) error {
 	err := l.configureParentNetworkingStep2(pidInt)
 	if err != nil {