dockerd --iptables=false adds DOCKER-USER chain and modify FORWARD chain anyway #136

ass3mbler · 2017-10-18T16:38:05Z

Issue description

This is a bug report

dockerd (in Docker version 17.09.0-ce, build afdb6d4) still adds the DOCKER-USER chain and modifies the FORWARD chain of the system, even when specifying the --iptables=false command line option. From the documentation:

--iptables=false prevents the Docker daemon from adding iptables rules.

Actual behavior

Initial system state

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

dockerd startup

# dockerd                        --bridge=$BRIDGE_FOR_DOCKER                        \
                        --default-gateway=$VLAN_GW                     \
                        --dns=$VLAN_GW                                         \
                        --ip-forward=false                                         \
                        --ip-masq=false                                             \
                        --iptables=false

System state AFTER dockerd is started

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DOCKER-USER  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain DOCKER-USER (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Output of docker version:

# docker --version
Docker version 17.09.0-ce, build afdb6d4

Output of dockerd: with log-level=debug

[...]
INFO[2017-10-18T19:29:00.127161968+02:00] Graph migration to content-addressability took 0.00 seconds
INFO[2017-10-18T19:29:00.128425657+02:00] Loading containers: start.
DEBU[2017-10-18T19:29:00.128541730+02:00] Option Experimental: false
DEBU[2017-10-18T19:29:00.128561767+02:00] Option DefaultDriver: bridge
DEBU[2017-10-18T19:29:00.128572980+02:00] Option DefaultNetwork: bridge
DEBU[2017-10-18T19:29:00.128601637+02:00] Network Control Plane MTU: 1500
DEBU[2017-10-18T19:29:00.137265625+02:00] Network (3d1968a) restored
DEBU[2017-10-18T19:29:00.147812823+02:00] Allocating IPv4 pools for network bridge (3d1968a69f6a809c876dd48f6863406bd98975bb0c766f56ca195a2d26e6c396)
DEBU[2017-10-18T19:29:00.147914464+02:00] RequestPool(LocalDefault, 10.0.110.0/24, , map[], false)
DEBU[2017-10-18T19:29:00.147981078+02:00] RequestAddress(LocalDefault/10.0.110.0/24, 10.0.110.7, map[RequestAddressType:com.docker.network.gateway])
DEBU[2017-10-18T19:29:00.148074662+02:00] RequestAddress(LocalDefault/10.0.110.0/24, 10.0.110.254, map[])
DEBU[2017-10-18T19:29:00.238350415+02:00] releasing IPv4 pools from network bridge (3d1968a69f6a809c876dd48f6863406bd98975bb0c766f56ca195a2d26e6c396)
DEBU[2017-10-18T19:29:00.238400391+02:00] ReleaseAddress(LocalDefault/10.0.110.0/24, 10.0.110.7)
DEBU[2017-10-18T19:29:00.238434285+02:00] ReleaseAddress(LocalDefault/10.0.110.0/24, 10.0.110.254)
DEBU[2017-10-18T19:29:00.238455487+02:00] ReleasePool(LocalDefault/10.0.110.0/24)
DEBU[2017-10-18T19:29:00.271778370+02:00] cleanupServiceBindings for 3d1968a69f6a809c876dd48f6863406bd98975bb0c766f56ca195a2d26e6c396
DEBU[2017-10-18T19:29:00.338727790+02:00] Allocating IPv4 pools for network bridge (b942ab7220a3a9d38c8edeb316d726f320a303c6fd51558e8e6ae068841642ce)
DEBU[2017-10-18T19:29:00.338785268+02:00] RequestPool(LocalDefault, 10.0.110.0/24, , map[], false)
DEBU[2017-10-18T19:29:00.338846284+02:00] RequestAddress(LocalDefault/10.0.110.0/24, 10.0.110.7, map[RequestAddressType:com.docker.network.gateway])
DEBU[2017-10-18T19:29:00.338894801+02:00] RequestAddress(LocalDefault/10.0.110.0/24, 10.0.110.254, map[])
DEBU[2017-10-18T19:29:00.443906556+02:00] Fail to initialize firewalld: Failed to connect to D-Bus system bus: dial unix /var/run/dbus/system_bus_socket: connect: no such file or directory, using raw iptables instead
DEBU[2017-10-18T19:29:00.447774069+02:00] /sbin/iptables, [--wait -t filter -n -L DOCKER-USER]
DEBU[2017-10-18T19:29:00.449089436+02:00] /sbin/iptables, [--wait -t filter -N DOCKER-USER]
DEBU[2017-10-18T19:29:00.450484274+02:00] /sbin/iptables, [--wait -t filter -C DOCKER-USER -j RETURN]
DEBU[2017-10-18T19:29:00.451875755+02:00] /sbin/iptables, [--wait -A DOCKER-USER -j RETURN]
DEBU[2017-10-18T19:29:00.453289482+02:00] /sbin/iptables, [--wait -t filter -C FORWARD -j DOCKER-USER]
DEBU[2017-10-18T19:29:00.454704161+02:00] /sbin/iptables, [--wait -I FORWARD -j DOCKER-USER]
INFO[2017-10-18T19:29:00.456151567+02:00] Loading containers: done.
INFO[2017-10-18T19:29:00.494739068+02:00] Docker daemon                                 commit=afdb6d4 graphdriver(s)=overlay2 version=17.09.0-ce
INFO[2017-10-18T19:29:00.494885547+02:00] Daemon has completed initialization
[...]

The text was updated successfully, but these errors were encountered:

oandrew · 2017-12-16T03:00:24Z

I have the same problem.

Looks like there is no check for the value of config.EnableIPTables.
https://github.com/docker/libnetwork/blob/f31bed11427ef107a7393c501cf8f6f0bee89463/controller.go#L885-L887

axblum · 2018-02-26T19:07:12Z

This also appears to be affecting docker version 17.12.0-ce as well

vfrans · 2018-03-01T14:06:22Z

Same on Docker version 17.12.1-ce, build 7390fc6

cwedgwood · 2018-03-29T06:38:21Z

also 18.03.0-ce

adamhj · 2018-05-05T07:04:24Z

Same on Docker version 18.03.1-ce, build 9ee9f40

pineda89 · 2018-06-13T14:53:20Z

+1

vladshved · 2018-08-07T00:18:11Z

this is look like a simple fix, why is it delayed for so long?

tianon · 2018-08-14T03:50:04Z

Just for completeness, this is also filed over at moby/moby#35777 (not sure if one or the other should be closed?)

Rickkwa · 2018-09-19T21:53:23Z

As a workaround on Centos with iptables-services installed:

I have the following configuration in /etc/systemd/system/docker.service.d/docker.conf which flushes the iptables every time after restarting the docker daemon.

[Service]
ExecStart=
ExecStart=/usr/bin/dockerd
ExecStartPost=
ExecStartPost=/usr/bin/systemctl reload iptables

davecb · 2018-09-20T17:55:55Z

We have this still showing up in

$ sudo docker version
Client:
 Version:           18.06.1-ce
 API version:       1.38
 Go version:        go1.10.3
 Git commit:        e68fc7a
 Built:             Tue Aug 21 17:23:03 2018
 OS/Arch:           linux/amd64
 Experimental:      false

If I understand this correctly, you need to decide to not insert a pair of rules, controlled by a parameter. It seems a very long time to validate and test a relatively simple "debt" issue. We're almost up to a year.

I'd suggest that it is important, even if not urgent, and deserves attention as soon as time permits.

bbailey1024 · 2018-11-28T19:50:56Z

Same issue. IPTables is managed by a separate process in our environment and the DOCKER-USER chain persists with iptables set to false.

docker version
Client:
 Version:           18.09.0-ce
 API version:       1.39
 Go version:        go1.11.2
 Git commit:        4d60db472b
 Built:             Fri Nov  9 00:05:34 2018
 OS/Arch:           linux/amd64
 Experimental:      false

Server:
 Engine:
  Version:          18.09.0-ce
  API version:      1.39 (minimum version 1.12)
  Go version:       go1.11.2
  Git commit:       4d60db472b
  Built:            Fri Nov  9 00:05:11 2018
  OS/Arch:          linux/amd64
  Experimental:     false

elboulangero · 2019-04-25T03:08:31Z

This was also reported in the debian bug reports, and is now a blocker for the buster release: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=903635

hagen4eg · 2019-05-29T16:09:11Z

Any updates about this issue?

full diffs: - moby/libnetwork@fc5a7d9...62a13ae - vishvananda/netlink@b2de5d1...v1.0.0 - vishvananda/netns@604eaf1...13995c7 notable changes in libnetwork: - moby/libnetwork#2366 Bump vishvananda/netlink to 1.0.0 - moby/libnetwork#2339 controller: Check if IPTables is enabled for arrangeUserFilterRule - addresses moby/libnetwork#2158 dockerd when run with --iptables=false modifies iptables by adding DOCKER-USER - addresses moby#35777 With iptables=false dockerd still creates DOCKER-USER chain and rules - addresses docker/for-linux#136 dockerd --iptables=false adds DOCKER-USER chain and modify FORWARD chain anyway - moby/libnetwork#2394 Make DNS records and queries case-insensitive - addresses moby#28689 Embedded DNS is case-sensitive - addresses moby#21169 hostnames with new networking are case-sensitive Signed-off-by: Sebastiaan van Stijn <[email protected]>

full diffs: - moby/libnetwork@fc5a7d9...62a13ae - vishvananda/netlink@b2de5d1...v1.0.0 - vishvananda/netns@604eaf1...13995c7 notable changes in libnetwork: - moby/libnetwork#2366 Bump vishvananda/netlink to 1.0.0 - moby/libnetwork#2339 controller: Check if IPTables is enabled for arrangeUserFilterRule - addresses moby/libnetwork#2158 dockerd when run with --iptables=false modifies iptables by adding DOCKER-USER - addresses moby/moby#35777 With iptables=false dockerd still creates DOCKER-USER chain and rules - addresses docker/for-linux#136 dockerd --iptables=false adds DOCKER-USER chain and modify FORWARD chain anyway - moby/libnetwork#2394 Make DNS records and queries case-insensitive - addresses moby/moby#28689 Embedded DNS is case-sensitive - addresses moby/moby#21169 hostnames with new networking are case-sensitive Signed-off-by: Sebastiaan van Stijn <[email protected]> Upstream-commit: 344b093258fcb2195fa393081e5224a6c766c798 Component: engine

digz6666 · 2019-07-29T13:21:04Z

Still having same problem on docker version 19.03.01 74ble89, it modifies the iptables rule.

thaJeztah · 2019-07-30T17:06:19Z

@digz6666 the fix is in master, not (yet) in a release

full diffs: - moby/libnetwork@fc5a7d9...62a13ae - vishvananda/netlink@b2de5d1...v1.0.0 - vishvananda/netns@604eaf1...13995c7 notable changes in libnetwork: - moby/libnetwork#2366 Bump vishvananda/netlink to 1.0.0 - moby/libnetwork#2339 controller: Check if IPTables is enabled for arrangeUserFilterRule - addresses moby/libnetwork#2158 dockerd when run with --iptables=false modifies iptables by adding DOCKER-USER - addresses moby#35777 With iptables=false dockerd still creates DOCKER-USER chain and rules - addresses docker/for-linux#136 dockerd --iptables=false adds DOCKER-USER chain and modify FORWARD chain anyway - moby/libnetwork#2394 Make DNS records and queries case-insensitive - addresses moby#28689 Embedded DNS is case-sensitive - addresses moby#21169 hostnames with new networking are case-sensitive Signed-off-by: Sebastiaan van Stijn <[email protected]> (cherry picked from commit 344b093) Signed-off-by: Sebastiaan van Stijn <[email protected]>

full diffs: - moby/libnetwork@fc5a7d9...62a13ae - vishvananda/netlink@b2de5d1...v1.0.0 - vishvananda/netns@604eaf1...13995c7 notable changes in libnetwork: - moby/libnetwork#2366 Bump vishvananda/netlink to 1.0.0 - moby/libnetwork#2339 controller: Check if IPTables is enabled for arrangeUserFilterRule - addresses moby/libnetwork#2158 dockerd when run with --iptables=false modifies iptables by adding DOCKER-USER - addresses moby/moby#35777 With iptables=false dockerd still creates DOCKER-USER chain and rules - addresses docker/for-linux#136 dockerd --iptables=false adds DOCKER-USER chain and modify FORWARD chain anyway - moby/libnetwork#2394 Make DNS records and queries case-insensitive - addresses moby/moby#28689 Embedded DNS is case-sensitive - addresses moby/moby#21169 hostnames with new networking are case-sensitive Signed-off-by: Sebastiaan van Stijn <[email protected]> (cherry picked from commit 344b093258fcb2195fa393081e5224a6c766c798) Signed-off-by: Sebastiaan van Stijn <[email protected]> Upstream-commit: f3e1aff81df959e9178433b77e7f3364c22aee59 Component: engine

full diffs: - moby/libnetwork@fc5a7d9...62a13ae - vishvananda/netlink@b2de5d1...v1.0.0 - vishvananda/netns@604eaf1...13995c7 notable changes in libnetwork: - moby/libnetwork#2366 Bump vishvananda/netlink to 1.0.0 - moby/libnetwork#2339 controller: Check if IPTables is enabled for arrangeUserFilterRule - addresses moby/libnetwork#2158 dockerd when run with --iptables=false modifies iptables by adding DOCKER-USER - addresses moby#35777 With iptables=false dockerd still creates DOCKER-USER chain and rules - addresses docker/for-linux#136 dockerd --iptables=false adds DOCKER-USER chain and modify FORWARD chain anyway - moby/libnetwork#2394 Make DNS records and queries case-insensitive - addresses moby#28689 Embedded DNS is case-sensitive - addresses moby#21169 hostnames with new networking are case-sensitive Signed-off-by: Sebastiaan van Stijn <[email protected]> Signed-off-by: zach <[email protected]>

seblu · 2019-10-22T14:06:01Z

Tested and still true in Arch Linux docker 19.03.4

thaJeztah · 2019-10-28T02:43:49Z

let me reopen, because this change was reverted; it was causing a breaking change in some environments docker-archive/engine#398

full diff: moby/libnetwork@0025177...90afbb0 includes: - docker/libnetwork#/2459 Fix Error Check in NewNetwork - docker/libnetwork#/2466 Revert "Merge pull request moby#2339 from phyber/iptables-check" - reverts docker/libnetwork#/2339 controller: Check if IPTables is enabled for arrangeUserFilterRule - re-opens moby/libnetwork#2158 dockerd when run with --iptables=false modifies iptables by adding DOCKER-USER - re-opens moby#35777 With iptables=false dockerd still creates DOCKER-USER chain and rules - re-opens docker/for-linux#136 dockerd --iptables=false adds DOCKER-USER chain and modify FORWARD chain anyway Signed-off-by: Sebastiaan van Stijn <[email protected]>

full diff: moby/libnetwork@0025177...90afbb0 includes: - docker/libnetwork#/2459 Fix Error Check in NewNetwork - docker/libnetwork#/2466 Revert "Merge pull request #2339 from phyber/iptables-check" - reverts docker/libnetwork#/2339 controller: Check if IPTables is enabled for arrangeUserFilterRule - re-opens moby/libnetwork#2158 dockerd when run with --iptables=false modifies iptables by adding DOCKER-USER - re-opens moby/moby#35777 With iptables=false dockerd still creates DOCKER-USER chain and rules - re-opens docker/for-linux#136 dockerd --iptables=false adds DOCKER-USER chain and modify FORWARD chain anyway Signed-off-by: Sebastiaan van Stijn <[email protected]> Upstream-commit: 9cf349d0f80d2399cdfad0321e0f181c2e7efa17 Component: engine

haimari · 2019-12-17T14:19:18Z

Tested and still true in Arch Linux docker 19.03.4

Any update on this ?

shadow00 · 2020-01-24T13:47:26Z

Tested and still true in Arch Linux docker 19.03.4

Any update on this ?

Still true on Docker version 19.03.5, build 633a0ea838

thaJeztah · 2020-01-24T14:03:36Z

The change was reverted #136 (comment) as it was breaking user setups

frederikbosch · 2020-03-30T08:20:14Z

This bug prevented complete networking in our containters, solved it by creating the file /etc/systemd/system/docker.service.d/docker.conf with the following contents.

[Service]
ExecStartPost=/sbin/iptables -D DOCKER-USER 1

graywolf · 2020-06-14T16:51:23Z

Still an issue.

talawahtech · 2020-07-11T22:23:19Z

FYI another potential work around for anyone who doesn't need bridge mode (I am only using host networking). If you pass in --iptables=false and --bridge=none then docker won't touch iptables at all.

Edit: Just another note if you use the options above you will lose networking access when you run docker build. You can get around that by also adding --network host (or whatever you are using) to the docker build command.

Docker version: 19.03.6-ce

dnephin mentioned this issue Oct 23, 2017

Dockers runs iptables despite --iptables=false docker/cli#637

Closed

tianon mentioned this issue Aug 14, 2018

With iptables=false dockerd still creates DOCKER-USER chain and rules moby/moby#35777

Closed

phyber mentioned this issue Feb 20, 2019

controller: Check if IPTables is enabled for arrangeUserFilterRule moby/libnetwork#2339

Merged

thaJeztah mentioned this issue Jun 25, 2019

bump libnetwork. vishvananda/netlink 1.0, vishvananda/netns moby/moby#39054

Merged

tiborvass closed this as completed in moby/moby#39054 Jun 27, 2019

thaJeztah mentioned this issue Aug 22, 2019

[19.03 backport] bump libnetwork to 92d1fbe1eb0883cf11d283cea8e658275146411d docker-archive/engine#330

Merged

thaJeztah reopened this Oct 28, 2019

thaJeztah mentioned this issue Nov 7, 2019

Revert "Merge pull request #2339 from phyber/iptables-check" moby/libnetwork#2466

Merged

thaJeztah mentioned this issue Nov 7, 2019

bump libnetwork 90afbb01e1d8acacb505a092744ea42b9f167377 moby/moby#40192

Merged

This was referenced Jul 6, 2023

add note on running docker daemon with iptables=true in WSL 2 in README ODU-CGA-CubeSat/sealion-workspace-image#42

Closed

correct link for setting iptables=true in notes ODU-CGA-CubeSat/sealion-workspace-image#51

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

dockerd --iptables=false adds DOCKER-USER chain and modify FORWARD chain anyway #136

dockerd --iptables=false adds DOCKER-USER chain and modify FORWARD chain anyway #136

ass3mbler commented Oct 18, 2017 •

edited

Loading

oandrew commented Dec 16, 2017

axblum commented Feb 26, 2018

vfrans commented Mar 1, 2018

cwedgwood commented Mar 29, 2018

adamhj commented May 5, 2018

pineda89 commented Jun 13, 2018

vladshved commented Aug 7, 2018 •

edited

Loading

tianon commented Aug 14, 2018

Rickkwa commented Sep 19, 2018

davecb commented Sep 20, 2018 •

edited

Loading

bbailey1024 commented Nov 28, 2018

elboulangero commented Apr 25, 2019

hagen4eg commented May 29, 2019

digz6666 commented Jul 29, 2019

thaJeztah commented Jul 30, 2019

seblu commented Oct 22, 2019

thaJeztah commented Oct 28, 2019

haimari commented Dec 17, 2019

shadow00 commented Jan 24, 2020

thaJeztah commented Jan 24, 2020

frederikbosch commented Mar 30, 2020

graywolf commented Jun 14, 2020

talawahtech commented Jul 11, 2020 •

edited

Loading

dockerd --iptables=false adds DOCKER-USER chain and modify FORWARD chain anyway #136

dockerd --iptables=false adds DOCKER-USER chain and modify FORWARD chain anyway #136

Comments

ass3mbler commented Oct 18, 2017 • edited Loading

Issue description

Actual behavior

oandrew commented Dec 16, 2017

axblum commented Feb 26, 2018

vfrans commented Mar 1, 2018

cwedgwood commented Mar 29, 2018

adamhj commented May 5, 2018

pineda89 commented Jun 13, 2018

vladshved commented Aug 7, 2018 • edited Loading

tianon commented Aug 14, 2018

Rickkwa commented Sep 19, 2018

davecb commented Sep 20, 2018 • edited Loading

bbailey1024 commented Nov 28, 2018

elboulangero commented Apr 25, 2019

hagen4eg commented May 29, 2019

digz6666 commented Jul 29, 2019

thaJeztah commented Jul 30, 2019

seblu commented Oct 22, 2019

thaJeztah commented Oct 28, 2019

haimari commented Dec 17, 2019

shadow00 commented Jan 24, 2020

thaJeztah commented Jan 24, 2020

frederikbosch commented Mar 30, 2020

graywolf commented Jun 14, 2020

talawahtech commented Jul 11, 2020 • edited Loading

ass3mbler commented Oct 18, 2017 •

edited

Loading

vladshved commented Aug 7, 2018 •

edited

Loading

davecb commented Sep 20, 2018 •

edited

Loading

talawahtech commented Jul 11, 2020 •

edited

Loading