- What I did

• 25.0 backport of Stop firewalld reload re-creating rules for deleted networks #49728
• 25.0 backport of libnetwork/d/{bridge,overlay}: fix firewalld reload handling #50443
• Backport some additional tests

On firewalld reload, all of Docker's iptables rules are removed. Docker notices the reload and restores the rules, with the exception that the Ingress rules for Docker Services in a Swarm mode are also not restored after firewalld reload and services become unreachable.

A further issue is that iptables.OnReloaded is used to register callbacks to restore per-network and per-container rules on firewalld reload. That works fine ... but it continues working after the network/container has been deleted, because there's no way to un-register a callback. So, a firewalld reload is likely to lead to creation of zombie iptables rules.

- How I did it

Restore iptables for current networks on firewalld reload

Using iptables.OnReloaded to restore individual per-network rules on firewalld reload means rules for deleted networks pop back in to existence (because there was no way to delete the callbacks on network-delete).

So, on firewalld reload, walk over current networks and ask them to restore their iptables rules.

Claim the configNetwork lock while doing that, and during ProgramExternalConnectivity / RevokeExternalConnectivity - to make sure there's no race between rules being deleted on network deletion (or default-gateway revocation), and restoring rules on firewalld reload.

Restore legacy links along with other iptables rules

On firewalld reload, all the iptables rules are deleted. Legacy links use iptables.OnReloaded to achieve that - but there's no way to delete an OnReloaded callback. So, a firewalld reload after the linked containers are deleted results in zombie rules being re-created.

Legacy links are created by ProgramExternalConnectivity, but removed in Leave (rather than RevokeExternalConnectivity).

Restore ingress iptables rules in swarm mode

On firewalld reload, walk over current service binding and ask them to restore iptables.

So ...

• restore legacy links for current endpoints, along with the other per-network/per-port rules.
• move link-removal to RevokeExternalConnectivity, so that it happens with the configNetwork lock held.

- How to verify it

On a host running firewalld, with this in daemon.json ...

        "icc": false,
        "ipv6": true,
        "fixed-cidr-v6": "fddd::/64",

Create a couple of networks running a container each, and a couple of legacy-linked containers on the default bridge ...

docker network create --ipv6 n1
docker network create --ipv6 n2
docker run -d --rm --network n1 nginx
docker run -d --rm --network n2 alpine
docker run --rm -d -ti -p 8080:80 --name nginx nginx
docker run --rm -ti --link nginx alpine

Store the output of iptables-save and ip6tables-save.

Reload firewalld, systemctl reload firewalld.

Compare the output of iptables-save and ip6tables-save with the originals. The order of some rules may change, because rules for the networks/container are unlikely to be restored in the order they were originally created in. There shouldn't be any other differences.

Check that the legacy-link still works.

Restore Ingress iptables rules on firewalld reload

In a swarm mode create a service:

docker swarm init
docker network create -d overlay n0
docker service create --name nginx --publish target=80,published=80 --replicas=1 --network n0 nginx

Store the output of iptables-save and ip6tables-save.

Reload firewalld, systemctl reload firewalld.

Compare the output of iptables-save with the originals. The order of some rules may change, because rules for the networks/container are unlikely to be restored in the order they were originally created in. There shouldn't be any other differences.

- Human readable description for the release notes

- Prevent restoration of iptables rules for deleted networks and containers on firewalld reload.
- Fix Swarm services becoming unreachable from published ports after a firewalld reload.

- A picture of a cute animal (not mandatory but encouraged)