Freegle / Iznik / 6494

70%

push

circleci

fix(ci): reset iptables-legacy FORWARD policy to unblock container networking

Docker 28/29 uses nftables (via iptables-nft) for firewall rules, but older
Docker runs leave stale iptables-legacy rules with FORWARD policy DROP. Since
both rule sets are active simultaneously, the legacy DROP policy blocks all
container traffic for networks managed by nftables but not in the legacy rules.

Resetting iptables-legacy FORWARD/INPUT/OUTPUT to ACCEPT on each CI run
unblocks container-to-container (e.g. batch->Percona) and container-to-internet
(e.g. Go module downloads) without touching Docker's nftables-managed rules.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

8976 of 10354 branches covered (86.69%)

Branch coverage included in aggregate %.

96090 of 143826 relevant lines covered (66.81%)

19.03 hits per line