+ /**
+ * Returns whether the specified flow entry is allowed to be
+ * installed/removed/modified based on the current container mode status.
+ * This call always returns true in the container instance of forwarding
+ * rules manager. It is meant for the global instance only (default
+ * container) of forwarding rules manager. Idea is that for assuring
+ * container isolation of traffic, flow installation in default container is
+ * blocked when in container mode (containers are present). The only flows
+ * that are allowed in container mode in the default container are the
+ * proactive flows, the ones automatically installed on the network node
+ * which forwarding mode has been configured to "proactive". These flows are
+ * needed by controller to discover the nodes topology and to discover the
+ * attached hosts for some SDN switches.
+ *
+ * @param flowEntry
+ * The flow entry to be installed/removed/modified
+ * @return true if not in container mode or if flowEntry is internally
+ * generated
+ */
+ private boolean isContainerModeAllowed(FlowEntry flowEntry) {
+ return (!inContainerMode) ? true : flowEntry.isInternal();
+ }
+