fix: warn instead of error when IP forwarding fails in containers

Downgrade the IP forwarding failure from an error to a warning,
as this is expected in containers with a read-only filesystem.
IP forwarding should be set at the host level, not inside a container.
Update comments to reflect this expectation and improve log clarity.

network-go/iptables/iptables.go

@@ -91,7 +91,9 @@ func (m *Manager) runInContainer(pid int, table string, args ...string) error {
 	return nil
 }
 
-// EnsureIPForward enables IP forwarding on the host
+// EnsureIPForward enables IP forwarding on the host.
+// Logs a warning if it fails (e.g. read-only filesystem in a container),
+// since this should be configured at the host level.
 func (m *Manager) EnsureIPForward() error {
 	cmd := exec.Command("sh", "-c", "echo 1 > /proc/sys/net/ipv4/ip_forward")
 	output, err := cmd.CombinedOutput()