Freegle / Iznik / 6480

70%

push

circleci

fix(ci): disable bridge-nf-call-iptables to fix Docker Compose v5 inter-container TCP

Docker Compose v5 adds raw PREROUTING DROP rules per container IP for network
isolation. When bridge-nf-call-iptables=1, bridged (container-to-container)
traffic passes through iptables with iifname=veth, incorrectly matching those
DROP rules. Result: TCP connections between containers are silently dropped
pre-conntrack, causing the batch container to spin forever waiting for percona.

Setting bridge-nf-call-iptables=0 makes bridge traffic bypass iptables entirely.
Added to both start-docker-services steps in the orb (main and two-phase).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

8975 of 10353 branches covered (86.69%)

Branch coverage included in aggregate %.

61656 of 98473 relevant lines covered (62.61%)

10.47 hits per line