Repository: moby/moby (language: go)

Issue:
DOCKER-USER chain not being used or created
### Description

Apparently if the chain already exists when Docker starts, it is not inserted at the top of the FORWARD chain like it normally is. This renders it completely useless, as the whole purpose is to let you add your rules before Docker's, since Docker inserts rules at the top. Otherwise you have to insert them after Docker starts, which you can do anyway without the DOCKER-USER chain.

### Reproduce

1. Create rules.v4 file
```
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:DOCKER-USER - [0:0]
-A DOCKER-USER -i docker0 ! -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-USER -i docker0 ! -o docker0 -d 192.168.0.0/16 -j REJECT
-A DOCKER-USER -i docker0 ! -o docker0 -d 10.0.0.0/8 -j REJECT
-A DOCKER-USER -i docker0 ! -o docker0 -d 172.16.0.0/12 -j REJECT
COMMIT
```

2. `iptables-restore rules.v4`
3. Restart docker so it regenerates its rules

### Expected behavior

At the top of FORWARD chain should be `-A FORWARD -j DOCKER-USER`.

### docker version

```bash
Client: Docker Engine - Community
 Version:           27.3.1
 API version:       1.47
 Go version:        go1.22.7
 Git commit:        ce12230
 Built:             Fri Sep 20 11:41:00 2024
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          27.3.1
  API version:      1.47 (minimum version 1.24)
  Go version:       go1.22.7
  Git commit:       41ca978
  Built:            Fri Sep 20 11:41:00 2024
  OS/Arch:          linux/amd64
  Experimental:     true
 containerd:
  Version:          1.7.22
  GitCommit:        7f7fdf5fed64eb6a7caf99b3e12efcf9d60e311c
 runc:
  Version:          1.1.14
  GitCommit:        v1.1.14-0-g2c9f560
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
```


### docker info

```bash
Client: Docker Engine - Community
 Version:    27.3.1
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.17.1
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.29.7
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 12
  Running: 7
  Paused: 0
  Stopped: 5
 Images: 11
 Server Version: 27.3.1
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 7f7fdf5fed64eb6a7caf99b3e12efcf9d60e311c
 runc version: v1.1.14-0-g2c9f560
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: builtin
  userns
  cgroupns
 Kernel Version: 5.15.0-122-generic
 Operating System: Ubuntu 22.04.5 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 8
 Total Memory: 94.22GiB
 Name: server
 ID: c81fb854-7df0-4ab6-8d81-8ebf67e9631a
 Docker Root Dir: /var/lib/docker/165536.165536
 Debug Mode: false
 Experimental: true
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: true
 Default Address Pools:
   Base: 172.16.0.0/16, Size: 24
   Base: fd3b:c25e:967e:1000::/52, Size: 64

WARNING: bridge-nf-call-iptables is disabled
WARNING: bridge-nf-call-ip6tables is disabled
```


### Additional Info

_No response_


Discussion / hints:
I was not able to reproduce it in a sterile test environment in a linux container, but it still happens on the host system.

This is my /etc/iptables/rules.v4:
```
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:DOCKER-USER - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m multiport --dports 22,39,80,443,5432,8448 -j ACCEPT
-A INPUT -p udp -m multiport --dports 39,443,8448 -j ACCEPT
-A INPUT -s 10.0.0.0/24 -j ACCEPT
-A INPUT -s 10.1.0.0/24 -j ACCEPT
-A INPUT -s 10.39.0.0/24 -j ACCEPT
-A INPUT -j REJECT
-A FORWARD ! -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -j REJECT
-A DOCKER-USER -i docker0 ! -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-USER -i docker0 ! -o docker0 -d 192.168.0.0/16 -j REJECT
-A DOCKER-USER -i docker0 ! -o docker0 -d 10.0.0.0/8 -j REJECT
-A DOCKER-USER -i docker0 ! -o docker0 -d 172.16.0.0/12 -j REJECT
COMMIT
```

And this is rules.v6:
```
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:DOCKER-USER - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m multiport --dports 22,39,80,443,5432,8448 -j ACCEPT
-A INPUT -p udp -m multiport --dports 39,443,8448 -j ACCEPT
-A INPUT -j REJECT
-A FORWARD ! -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -j REJECT
-A DOCKER-USER -i docker0 ! -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-USER -i docker0 ! -o docker0 -d fc00::/7 -j REJECT
COMMIT
```

And here is /etc/docker/daemon.json:
```
{
        "ipv6": true,
        "fixed-cidr-v6": "fd3b:c25e:967e::/64",
        "experimental": true,
        "ip6tables": true,
        "userland-proxy": false,
        "userns-remap": "default",
        "default-address-pools": [
                {"base": "172.16.0.0/16", "size": 24},
                {"base": "fd3b:c25e:967e:1000::/52", "size": 64}
        ],
        "live-restore": true
}
```

Whenever I restore iptables and restart docker, DOCKER-USER is missing from FORWARD chain and my firewall rules to protect private network from docker don't work. This is result:

```
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION-STAGE-1
-N DOCKER-ISOLATION-STAGE-2
-N DOCKER-USER
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m multiport --dports 22,39,80,443,5432,8448 -j ACCEPT
-A INPUT -p udp -m multiport --dports 39,443,8448 -j ACCEPT
-A INPUT -s 10.0.0.0/24 -j ACCEPT
-A INPUT -s 10.1.0.0/24 -j ACCEPT
-A INPUT -s 10.39.0.0/24 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD ! -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
-A DOCKER -d 172.16.0.5/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8080 -j ACCEPT
-A DOCKER -d 172.16.0.4/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 4000 -j ACCEPT
-A DOCKER -d 172.16.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 4000 -j ACCEPT
-A DOCKER -d 172.16.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8008 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -i docker0 ! -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-USER -d 192.168.0.0/16 -i docker0 ! -o docker0 -j REJECT --reject-with icmp-port-unreachable
-A DOCKER-USER -d 10.0.0.0/8 -i docker0 ! -o docker0 -j REJECT --reject-with icmp-port-unreachable
-A DOCKER-USER -d 172.16.0.0/12 -i docker0 ! -o docker0 -j REJECT --reject-with icmp-port-unreachable
```

and ip6table:
```
-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION-STAGE-1
-N DOCKER-ISOLATION-STAGE-2
-N DOCKER-USER
-A INPUT -i lo -j ACCEPT
-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m multiport --dports 22,39,80,443,5432,8448 -j ACCEPT
-A INPUT -p udp -m multiport --dports 39,443,8448 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD ! -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp6-port-unreachable
-A DOCKER -d fd3b:c25e:967e::242:ac10:5/128 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8080 -j ACCEPT
-A DOCKER -d fd3b:c25e:967e::242:ac10:3/128 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8008 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -i docker0 ! -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-USER -d fc00::/7 -i docker0 ! -o docker0 -j REJECT --reject-with icmp6-port-unreachable
```

Mysteriously missing `-A FORWARD -j DOCKER-USER` and I can't get done what I need! Something somewhere is triggering a bug...
Hi @ledlamp, thanks for reporting.

Could you [enable debug logs](https://docs.docker.com/engine/daemon/logs/#enable-debugging), restart your daemon and then post here all the logs related to iptables please?

Also, could you tell us which variant of iptables you're using (ie. `ls -l $(which iptables)`)?
FWIW even without my iptables it is just not creating DOCKER-USER chain anymore at all for some reason...

```
root@server:/etc/iptables# iptables -F; iptables -X; ip6tables -F; ip6tables -X; systemctl restart docker
root@server:/etc/iptables# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION-STAGE-1
-N DOCKER-ISOLATION-STAGE-2
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A DOCKER -d 172.16.0.5/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8080 -j ACCEPT
-A DOCKER -d 172.16.0.4/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 4000 -j ACCEPT
-A DOCKER -d 172.16.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 4000 -j ACCEPT
-A DOCKER -d 172.16.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8008 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
root@server:/etc/iptables# ip6tables -S
-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION-STAGE-1
-N DOCKER-ISOLATION-STAGE-2
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A DOCKER -d fd3b:c25e:967e::242:ac10:5/128 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8080 -j ACCEPT
-A DOCKER -d fd3b:c25e:967e::242:ac10:3/128 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8008 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
```

`which iptables` -> `/usr/sbin/iptables` -> `/etc/alternatives/iptables` -> `/usr/sbin/iptables-nft` -> `xtables-nft-multi`

That's a lot of symbolic links 🤯

I will check debug mode
debug log involving iptables

```
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.064294059-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -C FORWARD -j DOCKER-ISOLATION]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.065254341-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -D PREROUTING -m addrtype --dst-type LOCAL -j DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.104088022-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -D OUTPUT -m addrtype --dst-type LOCAL ! --dst 127.0.0.0/8 -j DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.105827195-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -D OUTPUT -m addrtype --dst-type LOCAL -j DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.136051796-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -D PREROUTING]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.137574718-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -D OUTPUT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.138713702-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -F DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.151986739-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -X DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.167966604-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -F DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.169189841-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -X DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.170134759-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -F DOCKER-ISOLATION-STAGE-1]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.171057202-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -X DOCKER-ISOLATION-STAGE-1]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.172080570-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -F DOCKER-ISOLATION-STAGE-2]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.173033225-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -X DOCKER-ISOLATION-STAGE-2]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.173943339-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -F DOCKER-ISOLATION]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.174844228-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -X DOCKER-ISOLATION]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.175760495-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -n -L DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.176937142-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -N DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.177917960-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -n -L DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.179169218-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -N DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.180108319-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -n -L DOCKER-ISOLATION-STAGE-1]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.191793768-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -N DOCKER-ISOLATION-STAGE-1]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.219949807-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -n -L DOCKER-ISOLATION-STAGE-2]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.222486461-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -N DOCKER-ISOLATION-STAGE-2]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.224519720-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -C DOCKER-ISOLATION-STAGE-1 -j RETURN]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.226788680-07:00" level=debug msg="/usr/sbin/iptables, [--wait -A DOCKER-ISOLATION-STAGE-1 -j RETURN]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.229149910-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -C DOCKER-ISOLATION-STAGE-2 -j RETURN]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.231336558-07:00" level=debug msg="/usr/sbin/iptables, [--wait -A DOCKER-ISOLATION-STAGE-2 -j RETURN]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.233541798-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -C DOCKER -i loopback0 -d 127.0.0.0/8 -j RETURN]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.235888028-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -C FORWARD -j DOCKER-ISOLATION]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.236877070-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -D PREROUTING -m addrtype --dst-type LOCAL -j DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.264018008-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -D OUTPUT -m addrtype --dst-type LOCAL ! --dst ::1/128 -j DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.265555244-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -D OUTPUT -m addrtype --dst-type LOCAL -j DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.280023719-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -D PREROUTING]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.281402844-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -D OUTPUT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.282528200-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -F DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.303983546-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -X DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.332000669-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -F DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.333264033-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -X DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.334240118-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -F DOCKER-ISOLATION-STAGE-1]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.335291763-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -X DOCKER-ISOLATION-STAGE-1]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.336618886-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -F DOCKER-ISOLATION-STAGE-2]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.337671399-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -X DOCKER-ISOLATION-STAGE-2]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.338646034-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -F DOCKER-ISOLATION]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.339591775-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -X DOCKER-ISOLATION]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.340589836-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -n -L DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.341753799-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -N DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.342863914-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -n -L DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.343963502-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -N DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.344964560-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -n -L DOCKER-ISOLATION-STAGE-1]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.346008352-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -N DOCKER-ISOLATION-STAGE-1]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.347032940-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -n -L DOCKER-ISOLATION-STAGE-2]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.348052796-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -N DOCKER-ISOLATION-STAGE-2]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.349055520-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -C DOCKER-ISOLATION-STAGE-1 -j RETURN]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.350083159-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -A DOCKER-ISOLATION-STAGE-1 -j RETURN]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.351105301-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -C DOCKER-ISOLATION-STAGE-2 -j RETURN]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.352148334-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -A DOCKER-ISOLATION-STAGE-2 -j RETURN]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.353393731-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -P FORWARD DROP]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.381014595-07:00" level=debug msg="Adding route to IPv6 network fd3b:c25e:967e::1/64 via device docker0"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.381264356-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -C POSTROUTING -s 172.16.0.0/24 ! -o docker0 -j MASQUERADE]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.383154263-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -C POSTROUTING -m addrtype --src-type LOCAL -o docker0 -j MASQUERADE]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.384920310-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -C FORWARD -i docker0 -o docker0 -j DROP]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.386229669-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -C FORWARD -i docker0 -o docker0 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.387307156-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -I FORWARD -i docker0 -o docker0 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.388422504-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -C FORWARD -i docker0 ! -o docker0 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.389530725-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -I FORWARD -i docker0 ! -o docker0 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.390685933-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -C PREROUTING -m addrtype --dst-type LOCAL -j DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.394589389-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.395976980-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -C OUTPUT -m addrtype --dst-type LOCAL -j DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.397248079-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.398886032-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -C FORWARD -o docker0 -j DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.400001363-07:00" level=debug msg="/usr/sbin/iptables, [--wait -I FORWARD -o docker0 -j DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.400977494-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.402198891-07:00" level=debug msg="/usr/sbin/iptables, [--wait -I FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.403450829-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -C FORWARD -j DOCKER-ISOLATION-STAGE-1]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.404676651-07:00" level=debug msg="/usr/sbin/iptables, [--wait -I FORWARD -j DOCKER-ISOLATION-STAGE-1]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.405651666-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -C POSTROUTING -s fd3b:c25e:967e::/64 ! -o docker0 -j MASQUERADE]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.406866879-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -C POSTROUTING -m addrtype --src-type LOCAL -o docker0 -j MASQUERADE]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.408255505-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -C FORWARD -i docker0 -o docker0 -j DROP]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.409253450-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -C FORWARD -i docker0 -o docker0 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.410235325-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -I FORWARD -i docker0 -o docker0 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.411279215-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -C FORWARD -i docker0 ! -o docker0 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.412385756-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -I FORWARD -i docker0 ! -o docker0 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.420086625-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -C PREROUTING -m addrtype --dst-type LOCAL -j DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.421616212-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.422817736-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -C OUTPUT -m addrtype --dst-type LOCAL -j DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.424432547-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.426281723-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -C FORWARD -o docker0 -j DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.428323069-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -I FORWARD -o docker0 -j DOCKER]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.429391706-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.430866782-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -I FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.432132694-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -C FORWARD -j DOCKER-ISOLATION-STAGE-1]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.433444147-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -I FORWARD -j DOCKER-ISOLATION-STAGE-1]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.434409655-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -C DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.435483161-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -I DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.436583780-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -C DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.437683940-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -I DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.439793391-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -C DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.441242252-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -I DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.442419540-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -C DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.443718546-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -I DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.444978676-07:00" level=debug msg="Network (1aaf483) restored"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.445875592-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -C DOCKER -p tcp -d 0/0 --dport 8660 -j DNAT --to-destination 172.16.0.5:8080]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.447932044-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -A DOCKER -p tcp -d 0/0 --dport 8660 -j DNAT --to-destination 172.16.0.5:8080]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.449914626-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -C POSTROUTING -p tcp -s 172.16.0.5 -d 172.16.0.5 --dport 8080 -j MASQUERADE]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.452038941-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -C DOCKER ! -i docker0 -o docker0 -p tcp -d 172.16.0.5 --dport 8080 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.455176343-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -A DOCKER ! -i docker0 -o docker0 -p tcp -d 172.16.0.5 --dport 8080 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.457360607-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -C DOCKER -p tcp -d 0/0 --dport 8660 -j DNAT --to-destination [fd3b:c25e:967e::242:ac10:5]:8080]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.459150496-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -A DOCKER -p tcp -d 0/0 --dport 8660 -j DNAT --to-destination [fd3b:c25e:967e::242:ac10:5]:8080]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.461005677-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -C POSTROUTING -p tcp -s fd3b:c25e:967e::242:ac10:5 -d fd3b:c25e:967e::242:ac10:5 --dport 8080 -j MASQUERADE]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.462641522-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -C DOCKER ! -i docker0 -o docker0 -p tcp -d fd3b:c25e:967e::242:ac10:5 --dport 8080 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.464084437-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -A DOCKER ! -i docker0 -o docker0 -p tcp -d fd3b:c25e:967e::242:ac10:5 --dport 8080 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.465686177-07:00" level=debug msg="Endpoint (151ae32) restored to network (1aaf483)"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.465791085-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -C DOCKER -p tcp -d 127.0.0.1 --dport 4800 -j DNAT --to-destination 172.16.0.4:4000]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.468238575-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -A DOCKER -p tcp -d 127.0.0.1 --dport 4800 -j DNAT --to-destination 172.16.0.4:4000]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.470365612-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -C POSTROUTING -p tcp -s 172.16.0.4 -d 172.16.0.4 --dport 4000 -j MASQUERADE]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.472787915-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -C DOCKER ! -i docker0 -o docker0 -p tcp -d 172.16.0.4 --dport 4000 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.474294468-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -A DOCKER ! -i docker0 -o docker0 -p tcp -d 172.16.0.4 --dport 4000 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.475702431-07:00" level=debug msg="Endpoint (306d86c) restored to network (1aaf483)"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.475784405-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -C DOCKER -p tcp -d 127.0.0.1 --dport 39400 -j DNAT --to-destination 172.16.0.2:4000]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.477432975-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -A DOCKER -p tcp -d 127.0.0.1 --dport 39400 -j DNAT --to-destination 172.16.0.2:4000]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.478960163-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -C POSTROUTING -p tcp -s 172.16.0.2 -d 172.16.0.2 --dport 4000 -j MASQUERADE]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.481493420-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -C DOCKER ! -i docker0 -o docker0 -p tcp -d 172.16.0.2 --dport 4000 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.483091145-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -A DOCKER ! -i docker0 -o docker0 -p tcp -d 172.16.0.2 --dport 4000 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.484707276-07:00" level=debug msg="Endpoint (90f1bed) restored to network (1aaf483)"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.484835681-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -C DOCKER -p tcp -d 0/0 --dport 8008 -j DNAT --to-destination 172.16.0.3:8008]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.488993467-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -A DOCKER -p tcp -d 0/0 --dport 8008 -j DNAT --to-destination 172.16.0.3:8008]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.491188312-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -C POSTROUTING -p tcp -s 172.16.0.3 -d 172.16.0.3 --dport 8008 -j MASQUERADE]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.495854570-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -C DOCKER ! -i docker0 -o docker0 -p tcp -d 172.16.0.3 --dport 8008 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.500735796-07:00" level=debug msg="/usr/sbin/iptables, [--wait -t filter -A DOCKER ! -i docker0 -o docker0 -p tcp -d 172.16.0.3 --dport 8008 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.502360741-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -C DOCKER -p tcp -d 0/0 --dport 8008 -j DNAT --to-destination [fd3b:c25e:967e::242:ac10:3]:8008]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.504680007-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -A DOCKER -p tcp -d 0/0 --dport 8008 -j DNAT --to-destination [fd3b:c25e:967e::242:ac10:3]:8008]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.506156261-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t nat -C POSTROUTING -p tcp -s fd3b:c25e:967e::242:ac10:3 -d fd3b:c25e:967e::242:ac10:3 --dport 8008 -j MASQUERADE]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.507807684-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -C DOCKER ! -i docker0 -o docker0 -p tcp -d fd3b:c25e:967e::242:ac10:3 --dport 8008 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.509227709-07:00" level=debug msg="/usr/sbin/ip6tables, [--wait -t filter -A DOCKER ! -i docker0 -o docker0 -p tcp -d fd3b:c25e:967e::242:ac10:3 --dport 8008 -j ACCEPT]"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.510620743-07:00" level=debug msg="Endpoint (b615e2e) restored to network (1aaf483)"
```

No mention of DOCKER-USER

There is also these

```
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.534417173-07:00" level=warning msg="WARNING: bridge-nf-call-iptables is disabled"
Sep 29 23:26:04 server dockerd[1023470]: time="2024-09-29T23:26:04.534449187-07:00" level=warning msg="WARNING: bridge-nf-call-ip6tables is disabled"
```

But it definitely created the DOCKER-USER chain when the system started cause it was there when I started building firewall.
Weirdly enough, this chain is only created when a new network is created. When a server reboots, no container is running yet, so the default bridge network is deleted and recreated. That's what triggers the creation of that chain.

However, I see `Endpoint ... restored to network (1aaf483)` in your logs. In that case, if `1aaf483` is the default network, it won't be recreated (eg. to not apply new settings).

What network `1aaf483` is? Is this the default `bridge` network? Also, do you have the following message logged?

```
there are running containers, updated network configuration will not take affect
```
It is default bridge

That message is logged.

So that's it I guess. It happens when restarting with `live-restore` enabled. Well that doesn't make a lot of sense does it. All the other iptables get regenerated. Well at least now I know it will work properly on reboot so it isn't such a big of a deal
> So that's it I guess. It happens when restarting with live-restore enabled. Well that doesn't make a lot of sense

Yeah! 😅 😬 We should fix that. cc @robmry 

Fix patch:
diff --git a/daemon/daemon_unix.go b/daemon/daemon_unix.go
index 6f38a9600eb3e..e37bc4bc9fc92 100644
--- a/daemon/daemon_unix.go
+++ b/daemon/daemon_unix.go
@@ -851,6 +851,10 @@ func (daemon *Daemon) initNetworkController(cfg *config.Config, activeSandboxes
 		return err
 	}
 
+	if err := daemon.netController.SetupUserChains(); err != nil {
+		log.G(context.TODO()).WithError(err).Warnf("initNetworkController")
+	}
+
 	// Set HostGatewayIP to the default bridge's IP if it is empty
 	setHostGatewayIP(daemon.netController, cfg)
 	return nil
diff --git a/libnetwork/controller.go b/libnetwork/controller.go
index 5ee8999d9ae3c..ab0ea994d4718 100644
--- a/libnetwork/controller.go
+++ b/libnetwork/controller.go
@@ -705,15 +705,22 @@ addToStore:
 		c.mu.Unlock()
 	}
 
-	// Sets up the DOCKER-USER chain for each iptables version (IPv4, IPv6)
-	// that's enabled in the controller's configuration.
+	if err := c.SetupUserChains(); err != nil {
+		log.G(context.TODO()).WithError(err).Warnf("Controller.NewNetwork %s:", name)
+	}
+
+	return nw, nil
+}
+
+// Sets up the DOCKER-USER chain for each iptables version (IPv4, IPv6) that's
+// enabled in the controller's configuration.
+func (c *Controller) SetupUserChains() error {
 	for _, ipVersion := range c.enabledIptablesVersions() {
 		if err := setupUserChain(ipVersion); err != nil {
-			log.G(context.TODO()).WithError(err).Warnf("Controller.NewNetwork %s:", name)
+			return err
 		}
 	}
-
-	return nw, nil
+	return nil
 }
 
 var joinCluster NetworkWalker = func(nw *Network) bool {


Test patch:
diff --git a/integration/daemon/daemon_test.go b/integration/daemon/daemon_test.go
index 64589c38b619c..75fad4a1d2a23 100644
--- a/integration/daemon/daemon_test.go
+++ b/integration/daemon/daemon_test.go
@@ -456,6 +456,7 @@ func TestLiveRestore(t *testing.T) {
 
 	t.Run("volume references", testLiveRestoreVolumeReferences)
 	t.Run("autoremove", testLiveRestoreAutoRemove)
+	t.Run("user chains", testLiveRestoreUserChainsSetup)
 }
 
 func testLiveRestoreAutoRemove(t *testing.T) {
@@ -674,6 +675,34 @@ func testLiveRestoreVolumeReferences(t *testing.T) {
 	})
 }
 
+func testLiveRestoreUserChainsSetup(t *testing.T) {
+	skip.If(t, testEnv.IsRootless(), "rootless daemon uses it's own network namespace")
+
+	t.Parallel()
+	ctx := testutil.StartSpan(baseContext, t)
+
+	t.Run("user chains should be inserted", func(t *testing.T) {
+		d := daemon.New(t)
+		d.StartWithBusybox(ctx, t, "--live-restore")
+		t.Cleanup(func() {
+			d.Stop(t)
+			d.Cleanup(t)
+		})
+
+		c := d.NewClientT(t)
+
+		cID := container.Run(ctx, t, c, container.WithCmd("top"))
+		defer c.ContainerRemove(ctx, cID, containertypes.RemoveOptions{Force: true})
+
+		d.Stop(t)
+		icmd.RunCommand("iptables", "--flush", "FORWARD").Assert(t, icmd.Success)
+		d.Start(t, "--live-restore")
+
+		result := icmd.RunCommand("iptables", "-S", "FORWARD", "1")
+		assert.Check(t, is.Equal(strings.TrimSpace(result.Stdout()), "-A FORWARD -j DOCKER-USER"), "the jump to DOCKER-USER should be the first rule in the FORWARD chain")
+	})
+}
+
 func TestDaemonDefaultBridgeWithFixedCidrButNoBip(t *testing.T) {
 	skip.If(t, runtime.GOOS == "windows")