Ask Your Question

Fedora 26, docker, & firewalld zones/services configuration issues

asked 2017-11-23 14:55:17 -0600

I've been trying to learn and work with docker. On first install it works using basic instructions from . And then it breaks after a reboot, which I believe is part of the typical Linux learning cycle :)

# journalctl -u firewalld.service WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w2 -t nat -n -L DOCKER' failed: Ad Naseum.

Which leads to a deeper dive into firewalld and it's relationship with the system. After much exploring, and editing all the the corrupted *.conf, *.xml files in /etc/firewalld & it's subdirectories, I set the default zone to public, check if its active, then recheck after connecting to wifi:

firewall-cmd --get-active-zones: FedoraServer interfaces: docker_gwbridge public interfaces: wlan0

Now it shows 2 active zones after connection. My docker interfaces & services keep jumping around in different zones, which I believe is related to servicehelpers autoconfiguring through NetworkManager, and the confusion between iptables & ebtables states everytime a new container is created and destroyed. This suggests that all zones are indeed in use at all times, or during the times that servicehelpers reconfigure them, which is often when playing with docker & it's many configurations. But my limited understanding of firewalls(past ubuntu user) is that a "zone" ie Public;Home;Server is chosen as a single default entity, and then all services, ports etc are placed & nested within it.

Could someone please explain the concept behind zones: are they singular in nature on a per network-interface; are they loaded dynamically by servicehelpers and active in multiples (ie:FedoraServer AND public)? How & where do I find the scripts that NetworkManager uses to autoconfigure and load both zones?

edit retag flag offensive close merge delete


How did you install docker?

aeperezt gravatar imageaeperezt ( 2017-11-23 17:53:58 -0600 )edit

5 Answers

Sort by ยป oldest newest most voted

answered 2017-11-26 19:05:31 -0600

After a lot of investigation, I now believe that the answer to my question regarding docker, firewall zones & networking is far to broad of a request to be answered in such a forum- it really requires a classroom. For those of us without such resources there is a fantastic tool called the Help Center. If you are having similar issues trying to run docker, may I suggest you take a far deeper look into networking concepts; the nmcli utilities; firewalld & firewallctl. Thanks for allowing me to post my question, & to learn from it. Lovin Fedora!

edit flag offensive delete link more

answered 2017-11-24 00:47:17 -0600

Running dnf list docker-ce --showduplicates | sort -r Last metadata expiration check: 0:02:10 ago on Thu 23 Nov Available Installed Packages docker-ce.x8664 17.09.0.ce-1.fc26 docker-ce-stable docker-ce.x8664 17.09.0.ce-1.fc26 @docker-ce-stable docker-ce.x86_64 17.09.0.ce-1.fc26 @docker-ce-stable Available Packages I dont understand package management well enough to understand how I have 3 identical packages installed, or how to reconcile this. I've been using --allowerasing. The 2 @ symbols might be a clue?

edit flag offensive delete link more

answered 2017-11-24 00:39:19 -0600

dnf install docker; worked for hello world, worked for wp/mysql, then broke. Journal entries began giving multiple iptables errors. dnf remove docker; dnf install docker-ce, according to instructions on ; dnf install docker-compose cockpit; successfully ran cockpit once & began experimenting with wp/mysql containers... then the firewall issues returned. One hec of a way to train :)

edit flag offensive delete link more

Question Tools

1 follower


Asked: 2017-11-23 14:55:17 -0600

Seen: 573 times

Last updated: Nov 23 '17