Rob Murray 67ffa47090 nftables: don't enable IP forwarding ...

For nftables only, never enable IP forwarding on the host. Instead,
return an error on network creation if forwarding is not enabled,
required by a bridge network, and --ip-forward=true.

If IPv4 forwarding is not enabled when the daemon is started with
nftables enabled and other config at defaults, the daemon will
exit when it tries to create the default bridge.

Otherwise, network creation will fail with an error if IPv4/IPv6
forwarding is not enabled when a network is created with IPv4/IPv6.

It's the user's responsibility to configure and secure their host
when they run Docker with nftables.

Signed-off-by: Rob Murray <rob.murray@docker.com>

2025-08-08 18:43:35 +01:00

..

testdata

iptables: Direct routing DROP rules per-container, not per-port

2025-04-24 12:00:44 +01:00

bridge_linux_test.go

nftables: don't enable IP forwarding

2025-08-08 18:43:35 +01:00

etchosts_test.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

firewall_linux_test.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

mac_addr_test.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

main_test.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

nat_windows_test.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00

port_mapping_linux_test.go

nftables: don't enable IP forwarding

2025-08-08 18:43:35 +01:00

resolvconf_test.go

Create github.com/moby/moby/v2 module

2025-07-31 10:13:29 -07:00