Docker 1.12 与 CentOS7的firewalld有冲突
CentOS7,安装Docker前,启动firewalld没问题。
安装Docker1.12以后,就会有以下报错。有人遇到类似的问题吗
centos7.2 + docker 1.12.3
sudo systemctl status firewalld.service
systemctl status firewalld.service
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2016-11-10 12:36:24 HKT; 1h 23min ago
Main PID: 2797 (firewalld)
Memory: 16.6M
CGroup: /system.slice/firewalld.service
└─2797 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid
Nov 10 12:36:49 254.246 firewalld: 2016-11-10 12:36:49 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -C FORWARD -i br-9413c4078517 ! -o br-9413c4078517 -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?).
Nov 10 12:36:49 254.246 firewalld: 2016-11-10 12:36:49 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -C FORWARD -o br-9413c4078517 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT' failed: iptables: Bad rule (does a matching rule exist in that chain?).
Nov 10 12:36:49 254.246 firewalld: 2016-11-10 12:36:49 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -C FORWARD -o br-9413c4078517 -j DOCKER' failed: iptables: No chain/target/match by that name.
Nov 10 12:36:49 254.246 firewalld: 2016-11-10 12:36:49 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -C DOCKER-ISOLATION -i br-9413c4078517 -o docker0 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?).
Nov 10 12:36:49 254.246 firewalld: 2016-11-10 12:36:49 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -C DOCKER-ISOLATION -i docker0 -o br-9413c4078517 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?).
Nov 10 12:36:49 254.246 firewalld: 2016-11-10 12:36:49 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -C DOCKER-ISOLATION -i br-9413c4078517 -o docker_gwbridge -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?).
Nov 10 12:36:49 254.246 firewalld: 2016-11-10 12:36:49 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -C DOCKER-ISOLATION -i docker_gwbridge -o br-9413c4078517 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?).
Nov 10 12:36:49 254.246 firewalld: 2016-11-10 12:36:49 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -C DOCKER-ISOLATION -i br-9413c4078517 -o br-4f02fe2cb22d -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?).
Nov 10 12:36:49 254.246 firewalld: 2016-11-10 12:36:49 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -C DOCKER-ISOLATION -i br-4f02fe2cb22d -o br-9413c4078517 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?).
Nov 10 12:36:49 254.246 firewalld: 2016-11-10 12:36:49 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -L DOCKER-INGRESS' failed: iptables: No chain/target/match by that name.
Hint: Some lines were ellipsized, use -l to show in full.
systemctl restart firewalld.service
systemctl status firewalld.service
1 个回复
徐磊 - BlackOps@Qunar
赞同来自:
参考下这个issue https://github.com/docker/docker/issues/16137