Home / user-91329

Kris Harper's questions

Martin Hope
Kris Harper
Asked: 2016-06-04 08:35:13 +0800 CST
  • 7

I am unable to start docker daemon. When I try I get a bunch of errors saying

invalid image sha256:{some sha here}, failed to verify image: sha256{some sha here}

and then one line that says

Error starting daemon: layer does not exist

I suspect the images are corrupted or something—there was an issue the last time this server was shut down. I don't mind removing the images, but I can't find any way to do that without getting docker started. I was hoping there was some sort of --skip verify argument, but I can't find anything like that.

How can I get docker started?

OS is CoreOS 1010.5.0.

docker coreos
Martin Hope
Kris Harper
Asked: 2015-10-06 13:51:57 +0800 CST
  • 4

I want to limit connections to running Docker containers. I have a set of iptables rules that do this effectively. However, the rule set hinges on applying my own rule chain ahead of the DOCKER chain.

Basically, I want this result

Chain FORWARD (policy DROP)
target     prot opt source               destination
PRE_DOCKER  all  --  0.0.0.0/0            0.0.0.0/0            /* Insert before Docker's filtering to apply our own */
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0

Chain PRE_DOCKER (policy DROP)
target     prot opt source               destination
//My own rules go here targeting the DOCKER chain

I am having trouble getting these rules set at system startup. I have a systemd file with the contents

[Unit]
Description=Restore iptables firewall rules
Before=iptables-store.service
Requires=docker.service
After=docker.service
Conflicts=shutdown.target

[Service]
Type=oneshot
ExecStart=/sbin/iptables-restore --noflush /var/lib/iptables/rules-save

[Install]
WantedBy=basic.target

But on startup, I get the error

iptables-restore v1.4.21: Couldn't load target `DOCKER':No such file or directory

which I assume means Docker service hasn't created its rules yet.

What is the correct way to structure my unit files or my iptables rules so that I get the desired output.

For completeness, here are the contents of /var/lib/iptables/rules-save that I have set up.

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:PRE_DOCKER - [0:0]

-I FORWARD -o docker0 -j PRE_DOCKER -m comment --comment "Insert before Docker's filtering to apply our own"
-A PRE_DOCKER ! -i eth0 -o docker0 -j DOCKER -m comment --comment "Anything coming from something other than the public interface send to DOCKER chain"
-A PRE_DOCKER -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -m comment --comment "Allow connections from established connections"
-A PRE_DOCKER -j DROP -m comment --comment "Drop anything else"

-A INPUT ! -i eth0 -j ACCEPT -m comment --comment "Accept anything coming from something other than the public interface"
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -m comment --comment "Allow connections from established connections"
COMMIT
iptables