def partition_containers(blockade_id, partitions):
    if not partitions or len(partitions) == 1:
        return

    # partitions without IP addresses can't be part of any
    # iptables rule anyway
    ip_partitions = [[c for c in parts if c.ip_address] for parts in partitions]

    all_nodes = frozenset(itertools.chain(*ip_partitions))

    for idx, chain_group in enumerate(_get_chain_groups(ip_partitions)):
        # create a new chain
        chain_name = partition_chain_name(blockade_id, idx+1)
        iptables_create_chain(chain_name)

        # direct all traffic of the chain group members to this chain
        for container in chain_group:
            iptables_insert_rule("FORWARD", src=container.ip_address, target=chain_name)

        def in_group(container):
            return any(container.name == x.name for x in chain_group)

        # block all transfer of partitions the containers of this chain group  are NOT part of
        chain_partition_members = set(itertools.chain(*[parts for parts in ip_partitions
                                                        if any(in_group(c) for c in parts)]))
        to_block = chain_partition_members - all_nodes

        for container in to_block:
            iptables_insert_rule(chain_name, dest=container.ip_address, target="DROP")
dataset/ETHPy150Open dcm-oss/blockade/blockade/net.py/partition_containers/swapped operands of `-`