headscale: machines in different namespaces can communicate

[majst01]

According to documentation this must not be possible if no ACLs are in place, but it is actually.

example:

tailscale status
100.64.0.1      6f440a00-be4d-11e9-8000-3cecef22f91c-is2r3rys 4a7dd76a-dc76-448c-8538-996c36b449b6 linux   -
100.64.0.7      eac0ae00-be83-11e9-8000-3cecef22f904-bstjvwbg 00000000-0000-0000-0000-000000000001 linux   active; direct 212.34.83.1:41641, tx 3504 rx 3056

root@shoot--ptznrc--inttest0-firewall-06749:~# ping  100.64.0.7
PING 100.64.0.7 (100.64.0.7) 56(84) bytes of data.
64 bytes from 100.64.0.7: icmp_seq=1 ttl=64 time=0.789 ms
64 bytes from 100.64.0.7: icmp_seq=2 ttl=64 time=0.725 ms
64 bytes from 100.64.0.7: icmp_seq=3 ttl=64 time=1.07 ms

this was done from he machine with ID: 6f440a00-be4d-11e9-8000-3cecef22f91c which is in a different namespace then eac0ae00-be83-11e9-8000-3cecef22f904