It's a whitelist of apps that are tunnelled through the relay, but apps don't have to use any sort of special networking library, pure Berkley sockets work just

It's a whitelist of apps that are tunnelled through the relay, but apps don't have to use any sort of special networking library, pure Berkley sockets work just fine through the relay. Also, anything that attempts to use port 80 goes through the relay, it doesn't have to be HTTP, as I said, plain BSD sockets work. This whitelist is implemented using the regular macOS/iOS per-app firewall. Not only this is accessible to users, but the whitelist matches based on the Mach-O UUID, which is an arbitrary number put in by the linker... The restriction on which apps can use iCloud Private Relay is trivially defeatable.