Yep, this sort of stuff happens and is extremely annoying. Libvirtd will do it for VM networking by default too.
The solution at the intersection of easy to implement and reliable is to just use
nftablesinstead ofiptables. Then, the extra rules automatically added by tools are usually much more predictable and easier to integrate with your own rules. Briefly, ifnftablesis enabled, most tools that mess with the firewall will create a new table inside ofnftableswith a lower-than-default priority, so that if you have your own custom table set up, the new rules won’t interfere with it. (That being said, it is possible that your higher-priority table will cause the automatically added rules not to behave as intended, in which case you may need to add more rules to your manually added table. But manual rules breaking automatic ones is better than automatic rules breaking manual ones imo).I’d say it’s not as it’s an implicit and surprising behavior with security implications.
I find Docker is one of those technologies that’s useful conceptually, but the actual implementation is a complete mess.
