It("sets the container subvolume path", func() {
		Expect(container.RootFSPath()).To(Equal("some-volume-path"))
	})

	It("sets the container grace time", func() {
		Expect(container.GraceTime()).To(Equal(1 * time.Second))
	})

	Describe("Starting", func() {
		It("should setup IPTables", func() {
			err := container.Start()
			Expect(err).ToNot(HaveOccurred())

			Expect(fakeIPTablesManager.ContainerSetupCallCount()).To(Equal(1))
			id, bridgeIface, ip, network := fakeIPTablesManager.ContainerSetupArgsForCall(0)
			Expect(id).To(Equal("some-id"))
			Expect(bridgeIface).To(Equal("some-bridge"))
			Expect(err).ToNot(HaveOccurred())
			Expect(ip).To(Equal(containerResources.Network.IP))
			Expect(network).To(Equal(containerResources.Network.Subnet))
		})

		Context("when IPTables setup fails", func() {
			JustBeforeEach(func() {
				fakeIPTablesManager.ContainerSetupReturns(errors.New("oh yes!"))
			})

			It("should return a wrapped error", func() {
				Expect(container.Start()).To(MatchError("container: start: oh yes!"))
			})
				NetIns: []linux_backend.NetInSpec{
					{
						HostPort:      1234,
						ContainerPort: 5678,
					},
					{
						HostPort:      1235,
						ContainerPort: 5679,
					},
				},
			})
			Expect(err).ToNot(HaveOccurred())

			Expect(fakeIPTablesManager.ContainerSetupCallCount()).To(Equal(1))
			containerID, bridgeName, ip, network := fakeIPTablesManager.ContainerSetupArgsForCall(0)
			Expect(containerID).To(Equal("test-container"))
			Expect(bridgeName).To(Equal("some-bridge"))
			Expect(ip.String()).To(Equal("1.2.3.4"))
			Expect(network.String()).To(Equal("2.3.4.0/30"))
		})

		for _, cmd := range []string{"in"} {
			command := cmd

			Context("when net.sh "+cmd+" fails", func() {
				disaster := errors.New("oh no!")

				JustBeforeEach(func() {
					fakeRunner.WhenRunning(
						fake_command_runner.CommandSpec{