{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/17320","repository_url":"https://api.github.com/repos/docker/docker","labels_url":"https://api.github.com/repos/docker/docker/issues/17320/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/17320/comments","events_url":"https://api.github.com/repos/docker/docker/issues/17320/events","html_url":"https://github.com/docker/docker/issues/17320","id":113103496,"number":17320,"title":"1.8.3 Docker iptables Missing Chain","user":{"login":"dcrdev","id":8715048,"avatar_url":"https://avatars.githubusercontent.com/u/8715048?v=3","gravatar_id":"","url":"https://api.github.com/users/dcrdev","html_url":"https://github.com/dcrdev","followers_url":"https://api.github.com/users/dcrdev/followers","following_url":"https://api.github.com/users/dcrdev/following{/other_user}","gists_url":"https://api.github.com/users/dcrdev/gists{/gist_id}","starred_url":"https://api.github.com/users/dcrdev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcrdev/subscriptions","organizations_url":"https://api.github.com/users/dcrdev/orgs","repos_url":"https://api.github.com/users/dcrdev/repos","events_url":"https://api.github.com/users/dcrdev/events{/privacy}","received_events_url":"https://api.github.com/users/dcrdev/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/group/networking","name":"group/networking","color":"F6FBFF"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2015-10-23T21:28:42Z","updated_at":"2016-03-18T12:20:50Z","closed_at":null,"body":"On 1.8.2 I'm getting the following errors in journalctl:\r\n\r\n    21:43 Scope libcontainer-991-systemd-test-default-dependencies.scope has no PIDs. Refusing. systemd\r\n     21:43 2015-10-23 21:43:37 ERROR: COMMAND_FAILED: '/sbin/iptables -w -t filter -C FORWARD -o docker0 -j DOCKER' failed: iptables: No chain/target/match by that name. firewalld\r\n     21:43 2015-10-23 21:43:37 ERROR: COMMAND_FAILED: '/sbin/iptables -w -t filter -n -L DOCKER' failed: iptables: No chain/target/match by that name. firewalld\r\n     21:43 2015-10-23 21:43:37 ERROR: COMMAND_FAILED: '/sbin/iptables -w -t nat -C OUTPUT -m addrtype --dst-type LOCAL -j DOCKER ! --dst 127.0.0.0/8' failed: iptables: No chain/target/match by that name. firewalld\r\n     21:43 2015-10-23 21:43:37 ERROR: COMMAND_FAILED: '/sbin/iptables -w -t nat -C PREROUTING -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables: No chain/target/match by that name. firewalld\r\n     21:43 2015-10-23 21:43:37 ERROR: COMMAND_FAILED: '/sbin/iptables -w -t nat -n -L DOCKER' failed: iptables: No chain/target/match by that name. firewalld\r\n     21:43 2015-10-23 21:43:37 ERROR: COMMAND_FAILED: '/sbin/iptables -w -t filter -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?). firewalld\r\n     21:43 2015-10-23 21:43:37 ERROR: COMMAND_FAILED: '/sbin/iptables -w -t filter -C FORWARD -i docker0 ! -o docker0 -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?). firewalld\r\n     21:43 2015-10-23 21:43:37 ERROR: COMMAND_FAILED: '/sbin/iptables -w -t filter -C FORWARD -i docker0 -o docker0 -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?). firewalld\r\n     21:43 2015-10-23 21:43:37 ERROR: COMMAND_FAILED: '/sbin/iptables -w -D FORWARD -i docker0 -o docker0 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?). firewalld\r\n     21:43 2015-10-23 21:43:37 ERROR: COMMAND_FAILED: '/sbin/iptables -w -t nat -C POSTROUTING -s 172.17.42.1/16 ! -o docker0 -j MASQUERADE' failed: iptables: No chain/target/match by that name. firewalld\r\n     21:43 2015-10-23 21:43:37 ERROR: COMMAND_FAILED: '/sbin/iptables -w -t nat -X DOCKER' failed: iptables: No chain/target/match by that name. firewalld\r\n     21:43 2015-10-23 21:43:37 ERROR: COMMAND_FAILED: '/sbin/iptables -w -t nat -F DOCKER' failed: iptables: No chain/target/match by that name. firewalld\r\n     21:43 2015-10-23 21:43:37 ERROR: COMMAND_FAILED: '/sbin/iptables -w -t nat -D OUTPUT' failed: iptables: Bad rule (does a matching rule exist in that chain?). firewalld\r\n     21:43 2015-10-23 21:43:37 ERROR: COMMAND_FAILED: '/sbin/iptables -w -t nat -D PREROUTING' failed: iptables: Bad rule (does a matching rule exist in that chain?). firewalld\r\n     21:43 2015-10-23 21:43:37 ERROR: COMMAND_FAILED: '/sbin/iptables -w -t nat -D OUTPUT -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables v1.4.21: Couldn't load target `DOCKER':No such file or directory Try `iptables -h' or 'iptables --help' for more information. firewalld\r\n     21:43 2015-10-23 21:43:37 ERROR: COMMAND_FAILED: '/sbin/iptables -w -t nat -D OUTPUT -m addrtype --dst-type LOCAL ! --dst 127.0.0.0/8 -j DOCKER' failed: iptables v1.4.21: Couldn't load target `DOCKER':No such file or directory Try `iptables -h' or 'iptables --help' for more information. firewalld\r\n     21:43 2015-10-23 21:43:37 ERROR: COMMAND_FAILED: '/sbin/iptables -w -t nat -D PREROUTING -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables v1.4.21: Couldn't load target `DOCKER':No such file or directory Try `iptables -h' or 'iptables --help' for more information. firewalld\r\n     21:43 Device dev-disk-by\\x2duuid-29b50e10\\x2d3913\\x2d4a4d\\x2da746\\x2d6b5d4fa1f63d.device appeared twice with different sysfs paths /sys/devices/virtual/block/loop0 and /sys/devices/virtual/block/dm-4 systemd\r\n     21:43 STATUS=daemon 'smbd' finished starting up and ready to serve connections smbd\r\n     21:43 [2015/10/23 21:43:35.540768, 0] ../lib/util/become_daemon.c:124(daemon_ready) smbd\r\n     21:43 Failed to start Docker Storage Setup. systemd\r\n\r\nuname -a\r\n\r\n    Linux hell-serv 4.2.3-200.fc22.x86_64 #1 SMP Thu Oct 8 03:23:55 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux\r\n\r\ndocker version \r\n```\r\nClient:\r\n Version:      1.8.2-fc22\r\n API version:  1.20\r\n Package Version: docker-1.8.2-1.gitf1db8f2.fc22.x86_64\r\n Go version:   go1.4.2\r\n Git commit:   f1db8f2/1.8.2\r\n Built:        \r\n OS/Arch:      linux/amd64\r\n\r\nServer:\r\n Version:      1.8.2-fc22\r\n API version:  1.20\r\n Package Version: \r\n Go version:   go1.4.2\r\n Git commit:   f1db8f2/1.8.2\r\n Built:        \r\n OS/Arch:      linux/amd64\r\n```\r\n\r\ndocker info \r\n\r\n    Containers: 0\r\n    Images: 17\r\n    Storage Driver: devicemapper\r\n     Pool Name: docker-253:0-811851118-pool\r\n     Pool Blocksize: 65.54 kB\r\n     Backing Filesystem: xfs\r\n     Data file: /dev/loop0\r\n     Metadata file: /dev/loop1\r\n     Data Space Used: 2.905 GB\r\n     Data Space Total: 107.4 GB\r\n     Data Space Available: 2.01 GB\r\n     Metadata Space Used: 2.658 MB\r\n     Metadata Space Total: 2.147 GB\r\n     Metadata Space Available: 2.01 GB\r\n     Udev Sync Supported: true\r\n     Deferred Removal Enabled: false\r\n     Data loop file: /var/lib/docker/devicemapper/devicemapper/data\r\n     Metadata loop file: /var/lib/docker/devicemapper/devicemapper/metadata\r\n     Library Version: 1.02.93 (2015-01-30)\r\n    Execution Driver: native-0.2\r\n    Logging Driver: json-file\r\n    Kernel Version: 4.2.3-200.fc22.x86_64\r\n    Operating System: Fedora 22 (Twenty Two)\r\n    CPUs: 4\r\n    Total Memory: 14.69 GiB\r\n    Name: hell-serv\r\n    ID: D6PJ:6DIQ:2X3Q:2H7P:MQZP:I56U:VO65:DTYF:B5IO:UL4X:FCOP:LDNP\r\n\r\nSteps to reproduce\r\n1. Minimal Fedora 22 Server Install\r\n2. systemctl enable docker\r\n3  systemctl start docker\r\n4. journalctl -xe "},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/198328022","html_url":"https://github.com/docker/docker/issues/17320#issuecomment-198328022","issue_url":"https://api.github.com/repos/docker/docker/issues/17320","id":198328022,"user":{"login":"jboero","id":7536012,"avatar_url":"https://avatars.githubusercontent.com/u/7536012?v=3","gravatar_id":"","url":"https://api.github.com/users/jboero","html_url":"https://github.com/jboero","followers_url":"https://api.github.com/users/jboero/followers","following_url":"https://api.github.com/users/jboero/following{/other_user}","gists_url":"https://api.github.com/users/jboero/gists{/gist_id}","starred_url":"https://api.github.com/users/jboero/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jboero/subscriptions","organizations_url":"https://api.github.com/users/jboero/orgs","repos_url":"https://api.github.com/users/jboero/repos","events_url":"https://api.github.com/users/jboero/events{/privacy}","received_events_url":"https://api.github.com/users/jboero/received_events","type":"User","site_admin":false},"created_at":"2016-03-18T12:20:49Z","updated_at":"2016-03-18T12:20:49Z","body":"Interestingly enough I've noticed that adding \"--iptables=false\" option in /etc/sysconfig/docker (or /etc/sysconfig/docker-network) still shows the same errors even though the option is supposed to explicitly NOT add iptables rules.  Also the stock systemd service file adds a \"--ip-masq=true\" whether or not you set \"--ip-masq=false\"  so that's cool.\r\n\r\n```\r\n[jboero@centos03 ~]$ sudo systemctl restart firewalld\r\n[jboero@centos03 ~]$ sudo systemctl status firewalld -l\r\n● firewalld.service - firewalld - dynamic firewall daemon\r\n   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)\r\n   Active: active (running) since Fri 2016-03-18 11:19:10 GMT; 2s ago\r\n Main PID: 31055 (firewalld)\r\n   Memory: 16.5M\r\n   CGroup: /system.slice/firewalld.service\r\n           └─31055 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid\r\n\r\nMar 18 11:19:10 centos03 systemd[1]: Starting firewalld - dynamic firewall daemon...\r\nMar 18 11:19:10 centos03 systemd[1]: Started firewalld - dynamic firewall daemon.\r\n[jboero@centos03 ~]$ sudo systemctl restart docker\r\n[jboero@centos03 ~]$ sudo systemctl status docker\r\n● docker.service - Docker Application Container Engine\r\n   Loaded: loaded (/usr/lib/systemd/system/docker.service; disabled; vendor preset: disabled)\r\n  Drop-In: /usr/lib/systemd/system/docker.service.d\r\n           └─flannel.conf\r\n   Active: active (running) since Fri 2016-03-18 11:19:27 GMT; 11s ago\r\n     Docs: http://docs.docker.com\r\n Main PID: 31504 (docker)\r\n   Memory: 10.6M\r\n   CGroup: /system.slice/docker.service\r\n           └─31504 /usr/bin/docker daemon --iptables=false --ip-masq=false --bip=10.254.57.1/24 --ip-masq=true --mtu=1472\r\n\r\nMar 18 11:19:38 centos03 docker[31504]: time=\"2016-03-18T11:19:38.742092034Z\" level=info msg=\"GET /containers/json\"\r\nMar 18 11:19:38 centos03 docker[31504]: time=\"2016-03-18T11:19:38.745522179Z\" level=info msg=\"GET /containers/json\"\r\nMar 18 11:19:38 centos03 docker[31504]: time=\"2016-03-18T11:19:38.758695700Z\" level=info msg=\"GET /version\"\r\nMar 18 11:19:38 centos03 docker[31504]: time=\"2016-03-18T11:19:38.848957956Z\" level=info msg=\"GET /containers/json\"\r\nMar 18 11:19:38 centos03 docker[31504]: time=\"2016-03-18T11:19:38.953062000Z\" level=info msg=\"GET /containers/json\"\r\nMar 18 11:19:39 centos03 docker[31504]: time=\"2016-03-18T11:19:39.057663613Z\" level=info msg=\"GET /containers/json\"\r\nMar 18 11:19:39 centos03 docker[31504]: time=\"2016-03-18T11:19:39.161880722Z\" level=info msg=\"GET /containers/json\"\r\nMar 18 11:19:39 centos03 docker[31504]: time=\"2016-03-18T11:19:39.267104782Z\" level=info msg=\"GET /containers/json\"\r\nMar 18 11:19:39 centos03 docker[31504]: time=\"2016-03-18T11:19:39.371698541Z\" level=info msg=\"GET /containers/json\"\r\nMar 18 11:19:39 centos03 docker[31504]: time=\"2016-03-18T11:19:39.475819575Z\" level=info msg=\"GET /containers/json\"\r\n[jboero@centos03 ~]$ sudo systemctl status firewalld -l\r\n● firewalld.service - firewalld - dynamic firewall daemon\r\n   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)\r\n   Active: active (running) since Fri 2016-03-18 11:19:10 GMT; 31s ago\r\n Main PID: 31055 (firewalld)\r\n   Memory: 16.5M\r\n   CGroup: /system.slice/firewalld.service\r\n           └─31055 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid\r\n\r\nMar 18 11:19:10 centos03 systemd[1]: Starting firewalld - dynamic firewall daemon...\r\nMar 18 11:19:10 centos03 systemd[1]: Started firewalld - dynamic firewall daemon.\r\nMar 18 11:19:27 centos03 firewalld[31055]: 2016-03-18 11:19:27 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t nat -D PREROUTING -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables v1.4.21: Couldn't load target `DOCKER':No such file or directory\r\n                                           \r\n                                           Try `iptables -h' or 'iptables --help' for more information.\r\nMar 18 11:19:27 centos03 firewalld[31055]: 2016-03-18 11:19:27 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t nat -D OUTPUT -m addrtype --dst-type LOCAL ! --dst 127.0.0.0/8 -j DOCKER' failed: iptables v1.4.21: Couldn't load target `DOCKER':No such file or directory\r\n                                           \r\n                                           Try `iptables -h' or 'iptables --help' for more information.\r\nMar 18 11:19:27 centos03 firewalld[31055]: 2016-03-18 11:19:27 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t nat -D OUTPUT -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables v1.4.21: Couldn't load target `DOCKER':No such file or directory\r\n                                           \r\n                                           Try `iptables -h' or 'iptables --help' for more information.\r\nMar 18 11:19:27 centos03 firewalld[31055]: 2016-03-18 11:19:27 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t nat -D PREROUTING' failed: iptables: Bad rule (does a matching rule exist in that chain?).\r\nMar 18 11:19:27 centos03 firewalld[31055]: 2016-03-18 11:19:27 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t nat -D OUTPUT' failed: iptables: Bad rule (does a matching rule exist in that chain?).\r\nMar 18 11:19:27 centos03 firewalld[31055]: 2016-03-18 11:19:27 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t nat -F DOCKER' failed: iptables: No chain/target/match by that name.\r\nMar 18 11:19:27 centos03 firewalld[31055]: 2016-03-18 11:19:27 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t nat -X DOCKER' failed: iptables: No chain/target/match by that name.\r\n```"}}