docker.sh missing chain creation for Docker 28+ chains (DOCKER-INTERNAL, DOCKER-FORWARD)

[fsantiago07044]

Summary

After running csf -r, Docker fails to create new networks or restart existing ones, complaining about missing iptables chains. The extras/scripts/docker.sh post-script creates DOCKER, DOCKER-USER, DOCKER-ISOLATION-STAGE-1, and DOCKER-ISOLATION-STAGE-2, but does not create the newer chains introduced in Docker 28+ as part of its iptables refactor — notably DOCKER-INTERNAL and DOCKER-FORWARD (and likely others).

Restarting the Docker daemon resolves the issue temporarily, because Docker rebuilds all of its own chains on startup. But the problem recurs on the next csf -r.

Environment

• OS: Ubuntu 24.04
• Docker version: 29.5.2, build 79eb04c
• CSF version: v15.10 (generic)
• docker.sh version: 15.0.9 (as of 12.25.2025)

Steps to reproduce

1. Install CSF with the docker.sh post-script at /usr/local/include/csf/post.d/docker.sh.
2. Run a Docker Compose stack that creates user-defined bridge networks.
3. Confirm the stack is running.
4. Run sudo csf -r.
5. Run docker compose down && docker compose up -d.

Expected behavior

Containers come back up cleanly.

Actual behavior

Network creation fails with errors like:

Failed to Setup IP tables: Unable to enable DROP INCOMING rule:
(iptables failed: iptables --wait -t filter -I DOCKER-INTERNAL -i br-<hash> ! -d 172.18.0.0/16 -j DROP:
iptables: No chain/target/match by that name. (exit status 1))

And after adding DOCKER-INTERNAL manually as a workaround:

Failed to Setup IP tables: Unable to enable ACCEPT OUTGOING rule:
(iptables failed: iptables --wait -t filter -A DOCKER-FORWARD -i br-<hash> -j ACCEPT:
iptables: No chain/target/match by that name. (exit status 1))

Root cause

Around line 1531 of docker.sh:

chain_create DOCKER
chain_create DOCKER-USER
chain_create DOCKER-ISOLATION-STAGE-1
chain_create DOCKER-ISOLATION-STAGE-2
chain_create DOCKER nat

The earlier iptables-save | grep -v '\-j DOCKER' | iptables-restore strips all DOCKER-prefixed jump rules, then this block recreates the chains the script knows about. Chains introduced in Docker 28+ (DOCKER-INTERNAL, DOCKER-FORWARD, and possibly others) are not recreated, so subsequent Docker network operations fail when Docker tries to insert rules into chains that no longer exist.

Suggested fix

At minimum, add the newer chains to the creation block:

chain_create DOCKER-INTERNAL
chain_create DOCKER-FORWARD

Plus any FORWARD-chain hooks Docker normally installs for them. Ideally the script would query the running Docker daemon for the chains it expects, or be updated to track Docker's iptables layout across versions.

Workaround

Restart Docker via csfpost.sh:

# /etc/csf/csfpost.sh
#!/bin/bash
systemctl restart docker

This works because Docker rebuilds all required chains on startup, but it causes brief container downtime on every csf -r and is wasteful given the careful integration docker.sh performs.