{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/16137","repository_url":"https://api.github.com/repos/docker/docker","labels_url":"https://api.github.com/repos/docker/docker/issues/16137/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/16137/comments","events_url":"https://api.github.com/repos/docker/docker/issues/16137/events","html_url":"https://github.com/docker/docker/issues/16137","id":105360163,"number":16137,"title":"Docker vs. firewalld on CentOS 7","user":{"login":"stephanadler","id":7080862,"avatar_url":"https://avatars.githubusercontent.com/u/7080862?v=3","gravatar_id":"","url":"https://api.github.com/users/stephanadler","html_url":"https://github.com/stephanadler","followers_url":"https://api.github.com/users/stephanadler/followers","following_url":"https://api.github.com/users/stephanadler/following{/other_user}","gists_url":"https://api.github.com/users/stephanadler/gists{/gist_id}","starred_url":"https://api.github.com/users/stephanadler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stephanadler/subscriptions","organizations_url":"https://api.github.com/users/stephanadler/orgs","repos_url":"https://api.github.com/users/stephanadler/repos","events_url":"https://api.github.com/users/stephanadler/events{/privacy}","received_events_url":"https://api.github.com/users/stephanadler/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/group/networking","name":"group/networking","color":"F6FBFF"}],"state":"open","locked":false,"assignee":{"login":"aboch","id":10080882,"avatar_url":"https://avatars.githubusercontent.com/u/10080882?v=3","gravatar_id":"","url":"https://api.github.com/users/aboch","html_url":"https://github.com/aboch","followers_url":"https://api.github.com/users/aboch/followers","following_url":"https://api.github.com/users/aboch/following{/other_user}","gists_url":"https://api.github.com/users/aboch/gists{/gist_id}","starred_url":"https://api.github.com/users/aboch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aboch/subscriptions","organizations_url":"https://api.github.com/users/aboch/orgs","repos_url":"https://api.github.com/users/aboch/repos","events_url":"https://api.github.com/users/aboch/events{/privacy}","received_events_url":"https://api.github.com/users/aboch/received_events","type":"User","site_admin":false},"milestone":null,"comments":31,"created_at":"2015-09-08T11:35:31Z","updated_at":"2016-03-02T15:19:56Z","closed_at":null,"body":"Hi.\r\nIn https://docs.docker.com/v1.6/installation/centos/#installing-docker-centos-7 it is documented that docker can be run together with firewalld if you respect the order in which services are started, however I seem to have problems getting that to run. As far as the documentation says I would assume that the following would result in a clean state.\r\n\r\n```\r\n[root@App1 ~]# systemctl stop docker\r\n[root@App1 ~]# systemctl stop firewalld\r\n[root@App1 ~]# iptables -L\r\nChain INPUT (policy ACCEPT)\r\ntarget     prot opt source               destination\r\n\r\nChain FORWARD (policy ACCEPT)\r\ntarget     prot opt source               destination\r\nDOCKER     all  --  anywhere             anywhere\r\nACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED\r\nACCEPT     all  --  anywhere             anywhere\r\nACCEPT     all  --  anywhere             anywhere\r\n\r\nChain OUTPUT (policy ACCEPT)\r\ntarget     prot opt source               destination\r\n\r\nChain DOCKER (1 references)\r\ntarget     prot opt source               destination\r\n[root@App1 ~]# systemctl start firewalld\r\n[root@App1 ~]# systemctl start docker\r\n```\r\n\r\nEverything went fine up to now, I also can run containers, they have network connectivity etc.. The thing which does not seem to work is inter container communication. While debugging this, I came across the following lines in `/var/log/firewalld`, which are a direct result of the `[root@App1 ~]# systemctl start docker` command above:\r\n\r\n```\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -D PREROUTING -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables v1.4.21: Couldn't load target `DOCKER':No such file or directory\r\n\r\nTry `iptables -h' or 'iptables --help' for more information.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -D OUTPUT -m addrtype --dst-type LOCAL ! --dst 127.0.0.0/8 -j DOCKER' failed: iptables v1.4.21: Couldn't load target `DOCKER':No such file or directory\r\n\r\nTry `iptables -h' or 'iptables --help' for more information.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -D OUTPUT -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables v1.4.21: Couldn't load target `DOCKER':No such file or directory\r\n\r\nTry `iptables -h' or 'iptables --help' for more information.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -D PREROUTING' failed: iptables: Bad rule (does a matching rule exist in that chain?).\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -D OUTPUT' failed: iptables: Bad rule (does a matching rule exist in that chain?).\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -F DOCKER' failed: iptables: No chain/target/match by that name.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -X DOCKER' failed: iptables: No chain/target/match by that name.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -C POSTROUTING -s 172.17.42.1/16 ! -o docker0 -j MASQUERADE' failed: iptables: No chain/target/match by that name.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -D FORWARD -i docker0 -o docker0 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?).\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -C FORWARD -i docker0 -o docker0 -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?).\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -C FORWARD -i docker0 ! -o docker0 -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?).\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?).\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -n -L DOCKER' failed: iptables: No chain/target/match by that name.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -C PREROUTING -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables: No chain/target/match by that name.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -C OUTPUT -m addrtype --dst-type LOCAL -j DOCKER ! --dst 127.0.0.0/8' failed: iptables: No chain/target/match by that name.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -n -L DOCKER' failed: iptables: No chain/target/match by that name.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -C FORWARD -o docker0 -j DOCKER' failed: iptables: No chain/target/match by that name.\r\n```\r\n\r\nMy current thesis is, that a running firewalld causes a kind of a race condition which causes that the docker chain is not yet existing when docker already tries to add rules to it. When researching that issue I found other people having trouble with CentOS 7 and Docker, but no one so far described that behavior. \r\n\r\n```\r\ndocker version:\r\nClient version: 1.7.1\r\nClient API version: 1.19\r\nPackage Version (client): docker-1.7.1-108.el7.centos.x86_64\r\nGo version (client): go1.4.2\r\nGit commit (client): 3043001/1.7.1\r\nOS/Arch (client): linux/amd64\r\nServer version: 1.7.1\r\nServer API version: 1.19\r\nPackage Version (server): docker-1.7.1-108.el7.centos.x86_64\r\nGo version (server): go1.4.2\r\nGit commit (server): 3043001/1.7.1\r\nOS/Arch (server): linux/amd64\r\n```\r\n```\r\ndocker info:\r\nContainers: 8\r\nImages: 155\r\nStorage Driver: devicemapper\r\n Pool Name: docker-253:0-3146366-pool\r\n Pool Blocksize: 65.54 kB\r\n Backing Filesystem: extfs\r\n Data file: /dev/loop0\r\n Metadata file: /dev/loop1\r\n Data Space Used: 4.95 GB\r\n Data Space Total: 107.4 GB\r\n Data Space Available: 40.16 GB\r\n Metadata Space Used: 9.466 MB\r\n Metadata Space Total: 2.147 GB\r\n Metadata Space Available: 2.138 GB\r\n Udev Sync Supported: true\r\n Deferred Removal Enabled: false\r\n Data loop file: /var/lib/docker/devicemapper/devicemapper/data\r\n Metadata loop file: /var/lib/docker/devicemapper/devicemapper/metadata\r\n Library Version: 1.02.93-RHEL7 (2015-01-28)\r\nExecution Driver: native-0.2\r\nLogging Driver: json-file\r\nKernel Version: 3.10.0-229.11.1.el7.x86_64\r\nOperating System: CentOS Linux 7 (Core)\r\nCPUs: 12\r\nTotal Memory: 31.22 GiB\r\nName: App1\r\nID: SHSS:NWHQ:V3C7:KUCO:VUH6:4VH3:AOYV:N3TN:YTLI:7M5F:OKSZ:6FWY\r\n```\r\n```\r\nuname -a\r\nLinux USCL-HDApp1 3.10.0-229.11.1.el7.x86_64 #1 SMP Thu Aug 6 01:06:18 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/191284603","html_url":"https://github.com/docker/docker/issues/16137#issuecomment-191284603","issue_url":"https://api.github.com/repos/docker/docker/issues/16137","id":191284603,"user":{"login":"binarytemple","id":419046,"avatar_url":"https://avatars.githubusercontent.com/u/419046?v=3","gravatar_id":"","url":"https://api.github.com/users/binarytemple","html_url":"https://github.com/binarytemple","followers_url":"https://api.github.com/users/binarytemple/followers","following_url":"https://api.github.com/users/binarytemple/following{/other_user}","gists_url":"https://api.github.com/users/binarytemple/gists{/gist_id}","starred_url":"https://api.github.com/users/binarytemple/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/binarytemple/subscriptions","organizations_url":"https://api.github.com/users/binarytemple/orgs","repos_url":"https://api.github.com/users/binarytemple/repos","events_url":"https://api.github.com/users/binarytemple/events{/privacy}","received_events_url":"https://api.github.com/users/binarytemple/received_events","type":"User","site_admin":false},"created_at":"2016-03-02T15:19:56Z","updated_at":"2016-03-02T15:19:56Z","body":"Yes. In my experience I've seen a lot (at least 6) of these sort of high level firewall abstractions come and go over the last 10 years or so. Learning the syntax/configuration just shoehorns you into some particular distribution. My personal advice would be to just bite the bullet and learn iptables command syntax. It will stand you in much better stead in the long run. +1 to @InfoSec812 - resetting your network connections is not a durable solution to the issue - better to remove firewalld (strikes me it's tailored towards desktop users anyway) and create your own iptables rules file."}}