skills.rest
soulmachine
soulmachineCOMMUNITY
Explore all skills by this author →
𝕏@soulmachineGitHub

lxd-docker-firewall-conflict

Adjust iptables FORWARD policy to accept LXD bridge traffic.

3|1|Updated Mar 31, 2026
Search Tags:#Docker#networking#firewall#LXD#iptables
One-click install
npx skills add https://github.com/soulmachine/skills --skill lxd-docker-firewall-conflict
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: lxd-docker-firewall-conflict
Source: https://github.com/soulmachine/skills/tree/main/lxd-docker-firewall-conflict
Command: npx skills add https://github.com/soulmachine/skills --skill lxd-docker-firewall-conflict

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill diagnoses and resolves the Docker/LXD firewall conflict, enabling LXD containers/VMs to access the internet when running on a host with Docker.

Core Features & Use Cases

  • Firewall Conflict Resolution: Fix the well-known conflict where Docker's iptables FORWARD chain policy is set to DROP, affecting LXD network traffic.
  • Automated Fix: Automatically detect managed LXD bridges, add DOCKER-USER ACCEPT rules, and persist them with a systemd unit for reboot stability.
  • Use Case: If you encounter "Network is unreachable" errors in LXD containers or VMs, this Skill can help by accepting the LXD bridge in Docker's DOCKER-USER chain.

Quick Start

Run the command 'bash scripts/fix-lxd-docker-forward.sh' to apply the fix and restore internet access for LXD containers.

Frequently Asked Questions about lxd-docker-firewall-conflict

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
Why do LXD containers lose internet access when running on a Docker host?▼

The conflict occurs because Docker sets the iptables FORWARD chain policy to DROP, which blocks network traffic for LXD bridge interfaces. This prevents LXD containers and VMs from accessing the internet when both systems run on the same host.

How do I fix the Docker LXD iptables FORWARD chain conflict?▼

Run the fix-lxd-docker-forward.sh script to automatically add ACCEPT rules for managed LXD bridges in Docker's DOCKER-USER chain. This adjusts the iptables FORWARD policy and restores internet access for LXD containers.

Does the Docker LXD firewall fix persist across system reboots?▼

Yes, the fix persists across reboots by installing a systemd unit that re-applies the iptables DOCKER-USER ACCEPT rules on startup. This ensures LXD containers maintain network access after system restarts.

Do I need root privileges to resolve Docker and LXD networking conflicts?▼

Yes, root privileges are required to modify iptables configurations and create systemd units for persistence. The environment must be a Docker host with LXD installed and managed bridges configured.

What happens if I do not apply the DOCKER-USER ACCEPT rules for LXD?▼

Without the DOCKER-USER ACCEPT rules, LXD containers and VMs will encounter "Network is unreachable" errors. Docker's default iptables FORWARD DROP policy will continue to block LXD bridge traffic, preventing internet access.

Related Skills

Explore More Software Engineering Skills→
blacklanternsecurityblacklanternsecurity
253

linux-file-path-abuse

Exploit writable files, NFS misconfigurations, and library hijacking for Linux privilege escalation.

Official
Advanced
ksopylaksopyla

docker-debugger

Inspect container status, logs, and network connectivity in Docker Compose setups.

Community
Advanced
openshift-engopenshift-eng
112

Network Analysis

Analyze sosreport network configuration data to diagnose connectivity issues in Linux environments.

Community
Intermediate
chatermchaterm
50

firewall

Manage iptables, firewalld, and ufw firewall rules on Linux.

Community
Intermediate