Freegle / Iznik / 6490

70%

push

circleci

fix(docker): disable Docker 28 network hardening for compose network

Docker Engine 28 introduced per-container DROP rules in raw PREROUTING
that block inbound traffic unless ports are explicitly published. Due to
br_netfilter, the iifname check incorrectly drops container-to-container
traffic on the same network (vethXXX != bridge name).

Setting gateway_mode_ipv4: nat-unprotected on the default bridge network
opts out of this hardening, restoring the expected container-to-container
connectivity without affecting internet access from containers.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

8976 of 10354 branches covered (86.69%)

Branch coverage included in aggregate %.

61656 of 98473 relevant lines covered (62.61%)

10.47 hits per line