{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/16137","labels_url":"https://api.github.com/repos/docker/docker/issues/16137/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/16137/comments","events_url":"https://api.github.com/repos/docker/docker/issues/16137/events","html_url":"https://github.com/docker/docker/issues/16137","id":105360163,"number":16137,"title":"Docker vs. firewalld on CentOS 7","user":{"login":"stephanadler","id":7080862,"avatar_url":"https://avatars.githubusercontent.com/u/7080862?v=3","gravatar_id":"","url":"https://api.github.com/users/stephanadler","html_url":"https://github.com/stephanadler","followers_url":"https://api.github.com/users/stephanadler/followers","following_url":"https://api.github.com/users/stephanadler/following{/other_user}","gists_url":"https://api.github.com/users/stephanadler/gists{/gist_id}","starred_url":"https://api.github.com/users/stephanadler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stephanadler/subscriptions","organizations_url":"https://api.github.com/users/stephanadler/orgs","repos_url":"https://api.github.com/users/stephanadler/repos","events_url":"https://api.github.com/users/stephanadler/events{/privacy}","received_events_url":"https://api.github.com/users/stephanadler/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/group/networking","name":"group/networking","color":"F6FBFF"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-09-08T11:35:31Z","updated_at":"2015-09-08T20:56:54Z","closed_at":null,"body":"Hi.\r\nIn https://docs.docker.com/v1.6/installation/centos/#installing-docker-centos-7 it is documented that docker can be run together with firewalld if you respect the order in which services are started, however I seem to have problems getting that to run. As far as the documentation says I would assume that the following would result in a clean state.\r\n\r\n```\r\n[root@App1 ~]# systemctl stop docker\r\n[root@App1 ~]# systemctl stop firewalld\r\n[root@App1 ~]# iptables -L\r\nChain INPUT (policy ACCEPT)\r\ntarget     prot opt source               destination\r\n\r\nChain FORWARD (policy ACCEPT)\r\ntarget     prot opt source               destination\r\nDOCKER     all  --  anywhere             anywhere\r\nACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED\r\nACCEPT     all  --  anywhere             anywhere\r\nACCEPT     all  --  anywhere             anywhere\r\n\r\nChain OUTPUT (policy ACCEPT)\r\ntarget     prot opt source               destination\r\n\r\nChain DOCKER (1 references)\r\ntarget     prot opt source               destination\r\n[root@App1 ~]# systemctl start firewalld\r\n[root@App1 ~]# systemctl start docker\r\n```\r\n\r\nEverything went fine up to now, I also can run containers, they have network connectivity etc.. The thing which does not seem to work is inter container communication. While debugging this, I came across the following lines in `/var/log/firewalld`, which are a direct result of the `[root@App1 ~]# systemctl start docker` command above:\r\n\r\n```\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -D PREROUTING -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables v1.4.21: Couldn't load target `DOCKER':No such file or directory\r\n\r\nTry `iptables -h' or 'iptables --help' for more information.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -D OUTPUT -m addrtype --dst-type LOCAL ! --dst 127.0.0.0/8 -j DOCKER' failed: iptables v1.4.21: Couldn't load target `DOCKER':No such file or directory\r\n\r\nTry `iptables -h' or 'iptables --help' for more information.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -D OUTPUT -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables v1.4.21: Couldn't load target `DOCKER':No such file or directory\r\n\r\nTry `iptables -h' or 'iptables --help' for more information.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -D PREROUTING' failed: iptables: Bad rule (does a matching rule exist in that chain?).\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -D OUTPUT' failed: iptables: Bad rule (does a matching rule exist in that chain?).\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -F DOCKER' failed: iptables: No chain/target/match by that name.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -X DOCKER' failed: iptables: No chain/target/match by that name.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -C POSTROUTING -s 172.17.42.1/16 ! -o docker0 -j MASQUERADE' failed: iptables: No chain/target/match by that name.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -D FORWARD -i docker0 -o docker0 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?).\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -C FORWARD -i docker0 -o docker0 -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?).\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -C FORWARD -i docker0 ! -o docker0 -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?).\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?).\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -n -L DOCKER' failed: iptables: No chain/target/match by that name.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -C PREROUTING -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables: No chain/target/match by that name.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -C OUTPUT -m addrtype --dst-type LOCAL -j DOCKER ! --dst 127.0.0.0/8' failed: iptables: No chain/target/match by that name.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -n -L DOCKER' failed: iptables: No chain/target/match by that name.\r\n2015-09-08 07:27:13 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -C FORWARD -o docker0 -j DOCKER' failed: iptables: No chain/target/match by that name.\r\n```\r\n\r\nMy current thesis is, that a running firewalld causes a kind of a race condition which causes that the docker chain is not yet existing when docker already tries to add rules to it. When researching that issue I found other people having trouble with CentOS 7 and Docker, but no one so far described that behavior. \r\n\r\n```\r\ndocker version:\r\nClient version: 1.7.1\r\nClient API version: 1.19\r\nPackage Version (client): docker-1.7.1-108.el7.centos.x86_64\r\nGo version (client): go1.4.2\r\nGit commit (client): 3043001/1.7.1\r\nOS/Arch (client): linux/amd64\r\nServer version: 1.7.1\r\nServer API version: 1.19\r\nPackage Version (server): docker-1.7.1-108.el7.centos.x86_64\r\nGo version (server): go1.4.2\r\nGit commit (server): 3043001/1.7.1\r\nOS/Arch (server): linux/amd64\r\n```\r\n```\r\ndocker info:\r\nContainers: 8\r\nImages: 155\r\nStorage Driver: devicemapper\r\n Pool Name: docker-253:0-3146366-pool\r\n Pool Blocksize: 65.54 kB\r\n Backing Filesystem: extfs\r\n Data file: /dev/loop0\r\n Metadata file: /dev/loop1\r\n Data Space Used: 4.95 GB\r\n Data Space Total: 107.4 GB\r\n Data Space Available: 40.16 GB\r\n Metadata Space Used: 9.466 MB\r\n Metadata Space Total: 2.147 GB\r\n Metadata Space Available: 2.138 GB\r\n Udev Sync Supported: true\r\n Deferred Removal Enabled: false\r\n Data loop file: /var/lib/docker/devicemapper/devicemapper/data\r\n Metadata loop file: /var/lib/docker/devicemapper/devicemapper/metadata\r\n Library Version: 1.02.93-RHEL7 (2015-01-28)\r\nExecution Driver: native-0.2\r\nLogging Driver: json-file\r\nKernel Version: 3.10.0-229.11.1.el7.x86_64\r\nOperating System: CentOS Linux 7 (Core)\r\nCPUs: 12\r\nTotal Memory: 31.22 GiB\r\nName: App1\r\nID: SHSS:NWHQ:V3C7:KUCO:VUH6:4VH3:AOYV:N3TN:YTLI:7M5F:OKSZ:6FWY\r\n```\r\n```\r\nuname -a\r\nLinux USCL-HDApp1 3.10.0-229.11.1.el7.x86_64 #1 SMP Thu Aug 6 01:06:18 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/138697536","html_url":"https://github.com/docker/docker/issues/16137#issuecomment-138697536","issue_url":"https://api.github.com/repos/docker/docker/issues/16137","id":138697536,"user":{"login":"smuthali","id":4469324,"avatar_url":"https://avatars.githubusercontent.com/u/4469324?v=3","gravatar_id":"","url":"https://api.github.com/users/smuthali","html_url":"https://github.com/smuthali","followers_url":"https://api.github.com/users/smuthali/followers","following_url":"https://api.github.com/users/smuthali/following{/other_user}","gists_url":"https://api.github.com/users/smuthali/gists{/gist_id}","starred_url":"https://api.github.com/users/smuthali/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smuthali/subscriptions","organizations_url":"https://api.github.com/users/smuthali/orgs","repos_url":"https://api.github.com/users/smuthali/repos","events_url":"https://api.github.com/users/smuthali/events{/privacy}","received_events_url":"https://api.github.com/users/smuthali/received_events","type":"User","site_admin":false},"created_at":"2015-09-08T20:56:54Z","updated_at":"2015-09-08T20:56:54Z","body":"@stephanadler \r\n@mavenugo \r\n\r\nI have the same/similar issues as mentioned by @stephanadler .\r\nAttempted both with docker upstream package (docker-engine 1.8.1) and CentOS provided packages (docker 1.7.1) on CentOS 7.1 - I see unpredictable behavior with docker-engine/docker client startup. This happens consistently with firewalld running and sporadically with firewalld stopped/disabled. I am happy to provide addition details, but I do not want to clutter this post."}}