code: func (runner *runner) restoreInternal(args []string, data []byte, flush FlushFlag, counters RestoreCountersFlag) error {
  	runner.mu.Lock()
  	defer runner.mu.Unlock()
  
  	if !flush {
  		args = append(args, "--noflush")
  	}
  	if counters {
  		args = append(args, "--counters")
  	}
  	// create temp file through which to pass data
  	temp, err := ioutil.TempFile("", "kube-temp-iptables-restore-")
  	if err != nil {
  		return err
  	}
  	// make sure we delete the temp file
  	defer os.Remove(temp.Name())
  	// Put the filename at the end of args.
  	// NOTE: the filename must be at the end.
  	// See: https://git.netfilter.org/iptables/commit/iptables-restore.c?id=e6869a8f59d779ff4d5a0984c86d80db70784962
  	args = append(args, temp.Name())
  	if err != nil {
  		return err
  	}
  	// write data to the file
  	_, err = temp.Write(data)
  	temp.Close()
  	if err != nil {
  		return err
  	}
  	// run the command and return the output or an error including the output and error
  	b, err := runner.exec.Command(cmdIptablesRestore, args...).CombinedOutput()
  	if err != nil {
  		return fmt.Errorf("%v (%s)", err, b)
  	}
  	return nil
  }
docs: // restoreInternal is the shared part of Restore/RestoreAll