[Bug] Switching Container Port Guard backend to nftables causes dockerd to crash on startup when net.ipv4.ip_forward = 0 without pre-check or remediation

Contact Information

No response

1Panel Version

2.3.0

Problem Description

A. Divergent Behavioral Difference: iptables vs. nftables in Docker

There is a fundamental difference in how Docker (libnetwork) handles net.ipv4.ip_forward == 0 between firewall backends:

1. Legacy iptables Backend (Silent In-Memory Remediation):
   • Under the legacy iptables driver, if net.ipv4.ip_forward is 0, Docker emits a soft log warning (WARNING: IPv4 forwarding is disabled. Networking will not work.), but it automatically and silently modifies the kernel runtime memory /proc/sys/net/ipv4/ip_forward to 1.
   • Because Docker did this behind the scenes, many servers (even with #net.ipv4.ip_forward=1 commented out in /etc/sysctl.conf) ran fine without administrators ever realizing it.
2. Modern nftables Backend (Strict Assertion & Immediate Crash):
   • In Docker v26+ with "firewall-backend": "nftables", this silent in-memory auto-remediation logic was removed.
   • Instead, Docker enforces a strict assertion. If net.ipv4.ip_forward == 0, dockerd treats it as an unrecoverable failure and aborts startup:
     复制

     dockerd[...]: failed to start daemon: Error initializing network controller: error obtaining controller instance: failed to create NAT chain: ... (exit status 1)
     dockerd[...]: failed to start daemon: Error initializing network controller: IPv4 forwarding is disabled
     systemd[1]: docker.service: Main process exited, code=exited, status=1/FAILURE

B. Architectural Defect in 1Panel

In agent/app/service/firewall_docker.go and firewall_setting.go:

• 1Panel provides a one-click UI toggle to switch Docker's backend to nftables, but it assumes net.ipv4.ip_forward = 1 is already persistently enabled at the host level.
• When 1Panel applies "firewall-backend": "nftables":
  • It does not inspect /proc/sys/net/ipv4/ip_forward.
  • It does not persist net.ipv4.ip_forward = 1 to /etc/sysctl.d/.
• As a result, any host relying on clean Ubuntu defaults or using kernel hardening scripts (which explicitly maintain net.ipv4.ip_forward = 0) immediately suffers a total Docker collapse, and 1Panel loses connection to /var/run/docker.sock.

Steps to Reproduce

1. On a Linux server (e.g., Ubuntu 24.04 / 26.04), ensure IP forwarding is disabled (net.ipv4.ip_forward = 0), which is the factory default on clean Ubuntu/Debian installations and standard CIS/security hardening templates:
   bash复制

   sysctl -w net.ipv4.ip_forward=0

2. Log in to the 1Panel web console.
3. Navigate to System -> Firewall -> Settings.
4. In the Container Port Guard section, switch the Docker firewall backend to nftables and click apply/initialize.
5. 1Panel adds "firewall-backend": "nftables" to /etc/docker/daemon.json and restarts Docker.
6. Check Docker daemon status:
   bash复制

   systemctl status docker
   journalctl -u docker -n 50 --no-pager

7. Result: dockerd crashes immediately on startup with exit status 1 (failed to start daemon: Error initializing network controller: IPv4 forwarding is disabled), bringing down all running containers across the host.

The expected correct result

1. Pre-flight Kernel Parameter Check: Before applying "firewall-backend": "nftables" to /etc/docker/daemon.json, 1Panel should check /proc/sys/net/ipv4/ip_forward.
2. Automatic Remediation & Persistence: If net.ipv4.ip_forward = 0, 1Panel should either:
   • Alert the administrator that net.ipv4.ip_forward = 1 is strictly mandatory under Docker's new nftables driver; OR
   • Automatically persist net.ipv4.ip_forward = 1 into /etc/sysctl.d/99-1panel.conf and apply sysctl --system before restarting Docker.
3. Failure Health Check & Safe Rollback: If dockerd fails to start within 10–15 seconds after switching the backend, 1Panel should automatically revert /etc/docker/daemon.json back to "firewall-backend": "iptables" and restore the containers to prevent production outages.

Related log output

Additional Information

No response