Dear Maintainer,

   * What led up to the situation?

installed docker.io with existing qemu guests in bridge mode, did not do
anything else.

   * What was the outcome of this action?

qemu guests lost internet

   * What outcome did you expect instead?

qemu guests should still have internet OR the installer should notice that
other bridge users already exist and show a big fat warning.
Also, uninstalling docker.io should restore the original situation which it
does not.


In dmesg I found

Bridge firewalling registered
Initializing XFRM netlink socket

It seems this is what docker.io does.

I can fix the problem by disabling sysctl net.bridge.bridge-nf-
call-{ip6tables,iptables,arptables}
Found the solution here:
https://wiki.libvirt.org/Net.bridge.bridge-nf-call_and_sysctl.conf.html

apt remove --purge does NOT fix the problem, an additional reboot is needed.

In the attachment please find networking info before installing docker.io

This seems to be because docker includes some firewall rules which does not
play nice with existing firewall rules.  For example, in my case I use
nftables, and after docker.io is installed, I had to

  rmmod xt_conntrack xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo xt_addrtype nft_compat br_netfilter

in order to make my bridge working again.  It isn't only qemu guests which
are broken, it's everything connected to the host bridge besides the host
itself, - eg nspawn containers.

/mjt

Please review the package's postinst script to convince yourself that the Debian docker.io package does not ship any firewall rules:

https://salsa.debian.org/go-team/packages/docker/-/blob/master/debian/docker.io.postinst?ref_type=heads

However, the docker.io package does indeed manipulate iptables rules to provide container isolation. This is a well-known and documented feature at https://docs.docker.com/network/packet-filtering-firewalls/

The particular issue that you are experiencing is probably  described best at https://serverfault.com/questions/963759/docker-breaks-libvirt-bridge-network. That article also container an detailed description on why this is actually a feature and how to work around it.

On a personal note, consider installing the 'podman-docker' package instead of the 'docker.io' package, this might be sufficient depending on your use-case.

I'm leaving this bug open as I'm not the regular maintainer of the docker.io package. Probably this should be documented in the README.md file or similar.

Happy Holidays,
-rt

Does the suggestion on
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=865975 help?
TLDR, please enable net.ipv4.ip_forward before starting docker.

Am Freitag, dem 29.12.2023 um 02:46 +0800 schrieb Shengjing Zhu:
of the scope of this bug report.

To repeat: Installing docker.io breaks unrelated software. Even before
using docker.io, the installation process by itself breaks unrelated software.

If maintainers really think this is acceptable behaviour, IMHO the preinst script
MUST show a big fat warning BEFORE docker.io is installed. And maybe offer choices
for solutions.