Summary
Every worker in the containerlab topology installs a blackhole route meant to stop a tenant's egress falling through to the default route when a delivery SID has no decap route yet. Under the current addressing layout the range it blackholes does not overlap the node's real SID space, so it catches nothing and the safety net does not exist.
Verified on a live node: neither its own shard SID nor a gateway SID on the same locator falls inside the blackholed range, because node IDs land in a different hextet than the range assumes.
Outcome
The blackhole covers the SID space a node can actually issue, so an unresolved SID is discarded locally instead of following the default route out of the management interface.
Summary
Every worker in the containerlab topology installs a blackhole route meant to stop a tenant's egress falling through to the default route when a delivery SID has no decap route yet. Under the current addressing layout the range it blackholes does not overlap the node's real SID space, so it catches nothing and the safety net does not exist.
Verified on a live node: neither its own shard SID nor a gateway SID on the same locator falls inside the blackholed range, because node IDs land in a different hextet than the range assumes.
Outcome
The blackhole covers the SID space a node can actually issue, so an unresolved SID is discarded locally instead of following the default route out of the management interface.