make iptables rules management fail gracefully

[hellt]

Quite often users install docker via a package manager. Sometimes this results in docker to be installed without docker-managed iptables rules in place.

We need not to stop deployment/destroy when iptables errors occur, instead we should emit a warning error and keep moving

[LimeHat]

Docs say that both chains are used by docker?
https://docs.docker.com/network/iptables/

Docker installs two custom iptables chains named DOCKER-USER and DOCKER, and it ensures that incoming packets are always checked by these two chains first.

All of Docker’s iptables rules are added to the DOCKER chain. Do not manipulate this chain manually. If you need to add rules which load before Docker’s rules, add them to the DOCKER-USER chain. These rules are applied before any rules Docker creates automatically.

Agree on the last point.

[hellt]

Looks like the originally reported issue was captured on a system where chains were manually screwed up. Will update this when I get more details. As of now it seems when people install docker via apt/yum the docker chains are not there. Maybe something like docker service is missing with such installations, not sure

…

On Wed, 23 Feb 2022 at 12:07, Sergey ***@***.***> wrote: Docs say that both chains are used by docker? https://docs.docker.com/network/iptables/ Docker installs two custom iptables chains named DOCKER-USER and DOCKER, and it ensures that incoming packets are always checked by these two chains first. All of Docker’s iptables rules are added to the DOCKER chain. Do not manipulate this chain manually. If you need to add rules which load before Docker’s rules, add them to the DOCKER-USER chain. These rules are applied before any rules Docker creates automatically. Agree on the last point. — Reply to this email directly, view it on GitHub <#797 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABLKV5MCSZESKMCTNRIMSMLU4S5Y7ANCNFSM5PD7S2GA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[LimeHat]

Maybe docker/for-linux#810

[LimeHat]

Ok so docker-user first became available in 17.06

[hellt]

great. It is a miracle clab even worked with docker-1.13.1
the warn error has been added in 465a83b