I think this does the opposite of what I'd expect this attribute to do: setting ip_forward to true would not enable IP forwarding.

In any event, for conditionals surrounding a single resource, Chef convention is to use `only_if` and `not_if` inside the block, just like the `only_if` that's already inside `sysctl_param`. The fix would be changing this to: `only_if { node['platform'] == 'debian' && node['docker']['ip_forward'] }`