Hi Alban,
On Sat, Sep 12, 2026 at 05:55:28AM +0200, Alban Browaeys wrote:
I use Debops which preserves a set of previous RULES (for one FORWARD
rules) but this preserves the jump to FORWARD-early even though
FORWARD-early itself is not defined in my ferm rules set.
This preserves is mainly there to keep docker rules on restart and such.
Debian default /etc/ferm/ferm.conf is not affected because it empties
the FORWARD rule. But thus it purges docker rules on restart I
believe.
Can you try start order so that docker networking doesn't start before
ferm is finished? If that needs cooperation from the ferm systemd units,
you can try that with an override and then submit the requeste changes,
I'll include them when it is feasible.
Either you can interlock docker with ferm the same way as ferm-early is
interlocked with ferm, or ferm could write a marker file when it's
finished.
ferm should be as compatible as possble with things like docker and
libvirt as those software packages are the common cause for not
migrating to nft.
Once the system startup issue was solved, the next challenge will be
what happens with the docker chains and the rules that invoke them when
you rebuild ferm's rules.
Would you mind me downgrading this bug to normal and retitling it to
something along "startup order issues with ferm and docker"?
Greetings
Marc
--
-----------------------------------------------------------------------------
Marc Haber | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany | lose things." Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature | How to make an American Quilt | Fax: *49 6224 1600421
