sjat
172ae37953
base's inet-filter forward chain is policy-drop; on a Docker host that kills published-port DNAT + inter-container forwarding ON REBOOT (nftables loads default-deny before dockerd). This drop-in (loaded via base's /etc/nftables.d/*.nft include at boot) appends the container-bridge accepts so a rebooted Docker host keeps forwarding. Resolves FRICTION 2026-06-17 #1 and the GREEN half of ADR-025's acceptance test. NB nftables wildcard is br-*, not the iptables br-+. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
14 lines
552 B
Django/Jinja
14 lines
552 B
Django/Jinja
# {{ ansible_managed }}
|
|
# Allow container forwarding through base's default-deny forward chain (ADR-025 / FRICTION
|
|
# 2026-06-17 #1). Appended to base's `table inet filter` / `chain forward` via the
|
|
# /etc/nftables.d/*.nft include, and loaded by nftables.service at boot — exactly when the
|
|
# bug bit (default-deny forward loading before dockerd on reboot).
|
|
table inet filter {
|
|
chain forward {
|
|
ct state established,related accept
|
|
iifname "docker0" accept
|
|
oifname "docker0" accept
|
|
iifname "br-*" accept
|
|
oifname "br-*" accept
|
|
}
|
|
}
|