← Back to issue list

Check for docker upstream iptables installation for proper error message

View original Github issue

Metadata

Project
craft-providers
Number
#172
Type
issue
State
open
Author
sergiusens
Labels
Type: Enhancement
Created
Updated
Closed
—

Current evaluation

Enhancement to detect docker-installed iptables rules that break LXD networking and fail early with a fix suggestion. Tracked as CRAFT-1683; not implemented in source (only docs added).

Suggested action: keep open

Reason: The requested check does not exist: grepping the pinned HEAD (a94fb28) for 'iptables'/'docker' only hits docs/explanation/index.rst, and `git log --pickaxe -S iptables` shows no detection code was ever added. The issue is maintainer-authored (sergiusens), labelled 'Type: Enhancement', and explicitly tracked ('Tracking with CRAFT-1683'), so it is triaged and valid. What has landed is only the documentation mitigation — commit 20d154b 'docs: explanation on network issues (#185)' plus the NetworkError class in craft_providers/errors.py, which points users at the docs page after a failure — so the early check the issue asks for is still outstanding. Actionability is capped because the design is unspecified (where to run the check, whether sudo on the host is acceptable, how to avoid false positives, and multipass/non-Linux hosts).

Evaluated by: mr-cal-bot

Impact: 32 Quick Win: 11 Complexity: 48 Confidence: 74 Actionability: 66

Issue body

It would be helpful for craft-providers to check if the iptables rules that docker installs is there as it applies to more than just docker as specified on https://github.com/docker/for-linux/issues/103 ... craft-providers should do an early check and error out appropriately with a potential suggestion to fix it.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha
Impact: 32
Quick Win: 11
Complexity: 48
Confidence: 74
Actionability: 66
keep open Enhancement to detect docker-installed iptables rules that break LXD networking and fail early with a fix suggestion. Tracked as CRAFT-1683; not implemented in source (only docs added).
stealth/space-bunny-alpha
Impact: 52
Quick Win: 16
Complexity: 55
Confidence: 88
Actionability: 68
keep open Enhancement to detect host iptables rules that can break LXD networking and provide an actionable early error; maintainer-tracked as CRAFT-1683, but no implementation is present in the current source.
qwen3.6-35b-a3b-mtp-q6
Impact: 50
Quick Win: 32
Staleness: 45
Complexity: 35
Confidence: 70
Support Request: 10
keep open Enhancement to add docker iptables rule checking with proper error messages. Acknowledged by maintainer in April 2023, tracked as CRAFT-1683, no implementation yet.
qwen/qwen3.6-35b-a3b
Staleness: 75
Complexity: 15
Confidence: 70
Support Request: 0
close stale Enhancement to add an early check in craft-providers for docker's iptables rules and provide a clear error message. Currently tracked internally as CRAFT-1683 with no active development.
qwen3.6-35b-a3b-mtp-q6
Staleness: 72
Complexity: 10
Confidence: 70
Support Request: 0
needs triage Enhancement to add an early check in craft-providers for Docker iptables rules, providing a clear error message if missing. Currently tracked internally as CRAFT-1683 with minimal activity.

Update history

No update history recorded yet.

Related work

  • Related To: craft-providers#185 (confidence 78%)

    Commit 20d154b 'docs: explanation on network issues (#185)' added docs/explanation/index.rst describing the docker/LXD iptables conflict and the linked LXD guidance — the documentation half of this issue, not the automated check.

Related issues

No related issues found above the similarity threshold.