Debian Sid (Unstable) uses iptables-nft by default now to provide /sbin/iptables and still provides a /usr/sbin/iptables-legacy for compatibility.
Recent change in docker package that was released into Debian Sid on 1/17/2019 forces docker to favor iptables-legacy binary over the "default" iptables.
This causes "normal" iptables rules to show up under iptables -S and docker’s rules only under iptables-legacy -S
Specific impact in my setup was inconsistent iptables configuration and the docker container could not initiate outgoing connections any more.
When forcing the system to default to iptables-legacy, all rules will show up under iptables-legacy. In my case, the container was then able to initiate outgoing connections again
Description of Issue/Question
Debian Sid (Unstable) uses
iptables-nft
by default now to provide/sbin/iptables
and still provides a/usr/sbin/iptables-legacy
for compatibility. Recent change in docker package that was released into Debian Sid on 1/17/2019 forces docker to favor iptables-legacy binary over the "default" iptables. This causes "normal" iptables rules to show up underiptables -S
and docker’s rules only underiptables-legacy -S
Specific impact in my setup was inconsistent iptables configuration and the docker container could not initiate outgoing connections any more.
Setup
I recently upgraded docker package in Debian:
Which on the Debian side has the following change log: https://tracker.debian.org/news/1021701/accepted-dockerio-18061dfsg1-3-source-all-amd64-into-unstable/
Which seems to introduce the following docker commit: https://github.com/docker/libnetwork/commit/7da66eea9f68e4abc83ed2892114ec565eddd66a#diff-b90cadcd0928c1e490272f4761a52bac
Checking in the Debian source repo confirms the suspicion: docker.io 18.06.1+dfsg1-2 https://sources.debian.org/src/docker.io/18.06.1+dfsg1-2/libnetwork/iptables/iptables.go/
docker.io 18.06.1+dfsg1-3 https://sources.debian.org/src/docker.io/18.06.1+dfsg1-3/libnetwork/iptables/iptables.go/
Workaround
When forcing the system to default to iptables-legacy, all rules will show up under iptables-legacy. In my case, the container was then able to initiate outgoing connections again
Logs and other Evidence
18.06.1+dfsg1-2:
18.06.1+dfsg1-3: