Victor's room

Overview & Root Cause Summary: The error iptables failed: iptables --wait -t nat -A DOCKER ... No chain/target/match by that name occurs on Linux systems when the host firewall daemon (such as firewalld or ufw) is reloaded or restarted while Docker is active, flushing the custom DOCKER iptables chains that the Docker daemon relies on for container port forwarding.

Understanding the Root Causes

• Firewall Reload Flushed Docker Chains: Restarting or reloading firewalld or ufw rebuilds system iptables/nftables and completely drops all runtime Docker chains (DOCKER, DOCKER-USER, DOCKER-INGRESS).
• Out-of-Order Service Startup: During system boot, Docker started before the host firewall daemon, causing Docker’s network rules to be overwritten when the firewall initialized.
• Disabled iptables in Daemon Configuration: Docker’s daemon.json has "iptables": false while containers attempt to bind and publish host ports.

Step 1: Quick Fix (Restart the Docker Daemon)

Restarting the Docker daemon forces Docker to recreate its required custom iptables chains and network bridges.

# Restart Docker to automatically rebuild missing iptables chains
sudo systemctl restart docker

# Verify Docker status
sudo systemctl status docker

# Test container port binding
docker run --rm -p 8080:80 nginx:alpine

Step 2: Configure Systemd Service Dependencies

Ensure the host firewall daemon always starts before Docker to prevent boot-time race conditions.

# For firewalld users:
# Edit or override docker.service dependencies
sudo systemctl edit docker.service

# Add the following lines under the [Unit] section:
# [Unit]
# After=network-online.target firewalld.service
# Wants=network-online.target firewalld.service

# Reload systemd configuration
sudo systemctl daemon-reload

Step 3: UFW Integration & Docker Daemon Network Configuration

If using UFW, ensure Docker and UFW cooperate without wiping chains, or verify /etc/docker/daemon.json.

# Verify /etc/docker/daemon.json does not disable iptables
sudo cat /etc/docker/daemon.json
# Ensure "iptables": true (or remove "iptables": false)

# If using UFW, reload UFW then restart Docker:
sudo ufw reload
sudo systemctl restart docker

Verification & Testing Steps

Confirm that the DOCKER chain exists in the iptables nat table and test container deployment.

# 1. Check if the DOCKER chain exists in the NAT table
sudo iptables -t nat -L DOCKER -n -v

# 2. Deploy a test container with port mapping
docker run -d --name test-web -p 8088:80 nginx:alpine

# 3. Verify port reachability and cleanup
curl -I http://localhost:8088
docker rm -f test-web

Summary Comparison Table