Petr Tesařík
If your firewall starts behaving strangely after installing #docker on #opensuse #slowroll, the reason is that firewalld has switched to nft, but docker still uses iptables. You may have to install iptables (the CLI tool) to fix the damage.
Mar 25 at 1:21pmWeb
Show threadFernando F. ManceraMar 25

@ptesarik Shouldn't docker be using iptables-nft by default on openSUSE?

Or am I missing something?

Show threadPetr TesaříkMar 25
@ffmancera No idea. All I know is that packets were no longer forwarded through my default (NAT) libvirt network, and it took me way too long to find out that docker installation/startup did the equivalent of iptables -P FORWARD DROP. It was not visible anywhere in the output of nft list ruleset.
Show threadFernando F. ManceraMar 25
@ptesarik oh that is too bad
Show threadOleksandr Natalenko, MSE Mar 25
@ptesarik Too bad docker is still used.
Show threadPetr TesaříkMar 25
@oleksandr Please, yes, go fix cobbler to use a better tool for make test-debian12:
https://github.com/cobbler/cobbler
GitHub - cobbler/cobbler: Cobbler is a versatile Linux deployment server

Cobbler is a versatile Linux deployment server. Contribute to cobbler/cobbler development by creating an account on GitHub.

GitHub
Show threadOleksandr Natalenko, MSE Mar 25
@ptesarik
Show threadTomáš JanoušekMar 25
@ptesarik also I've heard that in this setup docker container ports might be exposed to the internet despite whatever firewalld config because the two interact a bit weird

better double check, or — I'd recommend this — switch to rootless docker/podman which doesn't touch iptables at all
Show threadPetr TesaříkMar 25

@liskin By now, docker has left my system and will never make a comeback. But why did nobody warn me before I broke my system?

Besides, why didn't the #opensuse docker package revert those changes to iptables at unistall time?

Show threadTomáš JanoušekMar 25
@ptesarik oh actually more vaguely remembering time - there's iptables the original and iptables-via-nftables shim

I have no idea which of these is better, but fairly certain the behaviour is different in surprising ways.

(also libvirt does something similar but I think they support nftables already?)
Show threadPetr TesaříkMar 25
@liskin It's complicated. Short answer: Yes, libvirt can work just fine with nft.
Long answer: Read this:
https://libvirt.org/firewall.html
libvirt: Firewall and network filtering in libvirt

libvirt, virtualization, virtualization API

Show threadTomáš JanoušekMar 25
@ptesarik oh right they explicitly detect and use firewalld, even better