It("should setup IPTables", func() {
			err := container.Start()
			Expect(err).ToNot(HaveOccurred())

			Expect(fakeIPTablesManager.ContainerSetupCallCount()).To(Equal(1))
			id, bridgeIface, ip, network := fakeIPTablesManager.ContainerSetupArgsForCall(0)
			Expect(id).To(Equal("some-id"))
			Expect(bridgeIface).To(Equal("some-bridge"))
			Expect(err).ToNot(HaveOccurred())
			Expect(ip).To(Equal(containerResources.Network.IP))
			Expect(network).To(Equal(containerResources.Network.Subnet))
		})

		Context("when IPTables setup fails", func() {
			JustBeforeEach(func() {
				fakeIPTablesManager.ContainerSetupReturns(errors.New("oh yes!"))
			})

			It("should return a wrapped error", func() {
				Expect(container.Start()).To(MatchError("container: start: oh yes!"))
			})

			It("should not call start.sh", func() {
				Expect(container.Start()).ToNot(Succeed())

				Expect(fakeRunner).ToNot(HaveExecutedSerially(
					fake_command_runner.CommandSpec{
						Path: containerDir + "/start.sh",
					},
				))
			})
								ContainerPort: 5679,
							},
						},

						NetOuts: []garden.NetOutRule{},
					})
					Expect(err).To(Equal(disaster))
				})
			})
		}

		Context("when iptables manager returns an error", func() {
			disaster := errors.New("oh no!")

			BeforeEach(func() {
				fakeIPTablesManager.ContainerSetupReturns(disaster)
			})

			It("should return the error", func() {
				err := container.Restore(linux_backend.LinuxContainerSpec{
					State:     "active",
					Events:    []string{},
					Resources: containerResources,
				})
				Expect(err).To(Equal(disaster))
			})
		})

		It("re-enforces the memory limit", func() {
			fakeOomWatcher.WatchStub = func(onOom func()) error {
				onOom()