Expect(sbox.LockCallCount()).To(Equal(1))
		Expect(sbox.UnlockCallCount()).To(Equal(1))
	})

	It("adds a dummy link to the sandbox namespace", func() {
		ns.ExecuteStub = func(callback func(*os.File) error) error {
			Expect(linkFactory.CreateDummyCallCount()).To(Equal(0))
			err := callback(nil)
			Expect(linkFactory.CreateDummyCallCount()).To(Equal(1))
			return err
		}

		err := startDNS.Execute(context)
		Expect(err).NotTo(HaveOccurred())

		Expect(ns.ExecuteCallCount()).To(Equal(1))

		Expect(linkFactory.CreateDummyCallCount()).To(Equal(1))
		linkName := linkFactory.CreateDummyArgsForCall(0)
		Expect(linkName).To(Equal("dns0"))
	})

	It("sets the address on the dummy device in the sandbox namespace", func() {
		ns.ExecuteStub = func(callback func(*os.File) error) error {
			Expect(addressManager.AddAddressCallCount()).To(Equal(0))
			err := callback(nil)
			Expect(addressManager.AddAddressCallCount()).To(Equal(1))
			return err
		}

		err := startDNS.Execute(context)
			Expect(command.ExecuteCallCount()).To(Equal(1))
			return err
		}

		inNamespace = commands.InNamespace{
			Namespace: namespace,
			Command:   command,
		}
	})

	It("executes the command in the specified namespace", func() {
		err := inNamespace.Execute(context)
		Expect(err).NotTo(HaveOccurred())

		Expect(namespace.ExecuteCallCount()).To(Equal(1))
	})

	It("executes the command with the correct context", func() {
		err := inNamespace.Execute(context)
		Expect(err).NotTo(HaveOccurred())

		Expect(command.ExecuteCallCount()).To(Equal(1))
		Expect(command.ExecuteArgsForCall(0)).To(Equal(context))
	})

	Context("when namespace execute fails", func() {
		BeforeEach(func() {
			namespace.ExecuteReturns(errors.New("go away"))
		})
		fakeNetlinker.NeighDeserializeReturns(&netlink.Neigh{}, nil)
	})

	It("subscribes in the sandbox namespace", func() {
		targetNS.ExecuteStub = func(callback func(*os.File) error) error {
			defer GinkgoRecover()
			Expect(fakeNetlinker.SubscribeCallCount()).To(Equal(0))
			err := callback(nil)
			Expect(fakeNetlinker.SubscribeCallCount()).To(Equal(1))
			return err
		}

		err := mySubscriber.Subscribe(targetNS, neighChan, doneChan)
		Expect(err).NotTo(HaveOccurred())

		Expect(targetNS.ExecuteCallCount()).To(Equal(1))
	})

	It("faithfully represents the netlink Neighbor in the return type", func() {
		someMac, _ := net.ParseMAC("01:02:03:04:05:06")
		fakeNetlinker.NeighDeserializeReturns(&netlink.Neigh{
			LinkIndex:    1,
			Family:       2,
			State:        netlink.NUD_STALE,
			Type:         4,
			Flags:        5,
			IP:           net.ParseIP("1.2.3.4"),
			HardwareAddr: someMac,
		}, nil)

		err := mySubscriber.Subscribe(targetNS, neighChan, doneChan)
			resolved <- neighbor

			ready = make(chan error, 1)
		})

		JustBeforeEach(func() {
			close(resolved)
		})

		AfterEach(func() {
			Eventually(ready).Should(BeClosed())
		})

		It("finds the vxlan device in the sandbox namespace", func() {
			ns.ExecuteStub = func(callback func(_ *os.File) error) error {
				if ns.ExecuteCallCount() == 1 {
					Expect(netlinker.LinkByNameCallCount()).To(Equal(0))
				}
				callback(nil)
				if ns.ExecuteCallCount() == 1 {
					Expect(netlinker.LinkByNameCallCount()).To(Equal(1))
				}
				return nil
			}

			inserter.HandleResolvedNeighbors(ready, ns, "some-vxlan-name", resolved)
			Eventually(ready).Should(BeClosed())

			Expect(ns.ExecuteCallCount()).To(Equal(2))
			Expect(netlinker.LinkByNameArgsForCall(0)).To(Equal("some-vxlan-name"))
		})
		It("it calls StartMonitor inside the HostNamespace", func() {

			hostNS.ExecuteStub = func(callback func(_ *os.File) error) error {
				Expect(fakeWatcher.StartMonitorCallCount()).To(Equal(0))
				callback(nil)
				Expect(fakeWatcher.StartMonitorCallCount()).To(Equal(1))
				return nil
			}

			err := startMonitor.Execute(context)
			Expect(err).NotTo(HaveOccurred())

			Expect(sandboxRepository.GetCallCount()).To(Equal(1))
			Expect(sandboxRepository.GetArgsForCall(0)).To(Equal("some-sandbox"))

			Expect(hostNS.ExecuteCallCount()).To(Equal(1))

			ns, linkName := fakeWatcher.StartMonitorArgsForCall(0)
			Expect(ns).To(Equal(sandboxNS))
			Expect(linkName).To(Equal("some-vxlan-name"))
		})

		Context("when getting the sandbox namespace fails", func() {
			BeforeEach(func() {
				sandboxRepository.GetReturns(nil, errors.New("potato"))
			})

			It("wraps and propogates the error", func() {
				err := startMonitor.Execute(context)
				Expect(err).To(MatchError("getting sandbox namespace: potato"))
			})
		})
	})

	Context("when there are no veth devices in the sandbox", func() {
		It("removes the vxlan device in the sandbox namespace", func() {
			sandboxNS.ExecuteStub = func(callback func(ns *os.File) error) error {
				Expect(linkFactory.DeleteLinkByNameCallCount()).To(Equal(0))
				err := callback(nil)
				Expect(linkFactory.DeleteLinkByNameCallCount()).To(Equal(1))
				return err
			}

			err := cleanupSandboxCommand.Execute(context)
			Expect(err).NotTo(HaveOccurred())

			Expect(sandboxNS.ExecuteCallCount()).To(Equal(1))
			Expect(linkFactory.DeleteLinkByNameArgsForCall(0)).To(Equal("some-vxlan"))
		})

		It("destroys the sandbox", func() {
			err := cleanupSandboxCommand.Execute(context)
			Expect(err).NotTo(HaveOccurred())

			Expect(sandboxRepo.DestroyCallCount()).To(Equal(1))
			Expect(sandboxRepo.DestroyArgsForCall(0)).To(Equal("sandbox-name"))
		})

		Context("when destroy fails with AlreadyDestroyedError", func() {
			BeforeEach(func() {
				sandboxRepo.DestroyReturns(sandbox.AlreadyDestroyedError)
			})