Merge pull request #13292 from coolljt0725/add_bridge_nf_to_docker_info

Add bridge-nf-call-iptables/bridge-nf-call-ipv6tables to docker info

api/client/info.go

@@ -76,6 +76,12 @@ func (cli *DockerCli) CmdInfo(args ...string) error {
 	if !info.IPv4Forwarding {
 		fmt.Fprintf(cli.err, "WARNING: IPv4 forwarding is disabled.\n")
 	}
+	if !info.BridgeNfIptables {
+		fmt.Fprintf(cli.err, "WARNING: bridge-nf-call-iptables is disabled\n")
+	}
+	if !info.BridgeNfIp6tables {
+		fmt.Fprintf(cli.err, "WARNING: bridge-nf-call-ip6tables is disabled\n")
+	}
 	if info.Labels != nil {
 		fmt.Fprintln(cli.out, "Labels:")
 		for _, attribute := range info.Labels {

api/types/types.go

@@ -153,6 +153,8 @@ type Info struct {
 	CpuCfsPeriod       bool
 	CpuCfsQuota        bool
 	IPv4Forwarding     bool
+	BridgeNfIptables   bool
+	BridgeNfIp6tables  bool
 	Debug              bool
 	NFd                int
 	OomKillDisable     bool

daemon/info.go

@@ -67,6 +67,8 @@ func (daemon *Daemon) SystemInfo() (*types.Info, error) {
 		CpuCfsPeriod:       daemon.SystemConfig().CpuCfsPeriod,
 		CpuCfsQuota:        daemon.SystemConfig().CpuCfsQuota,
 		IPv4Forwarding:     !daemon.SystemConfig().IPv4ForwardingDisabled,
+		BridgeNfIptables:   !daemon.SystemConfig().BridgeNfCallIptablesDisabled,
+		BridgeNfIp6tables:  !daemon.SystemConfig().BridgeNfCallIp6tablesDisabled,
 		Debug:              os.Getenv("DEBUG") != "",
 		NFd:                fileutils.GetTotalUsedFds(),
 		OomKillDisable:     daemon.SystemConfig().OomKillDisable,

pkg/sysinfo/sysinfo.go

@@ -3,11 +3,13 @@ package sysinfo
 // SysInfo stores information about which features a kernel supports.
 // TODO Windows: Factor out platform specific capabilities.
 type SysInfo struct {
-	MemoryLimit            bool
+	MemoryLimit                   bool
-	SwapLimit              bool
+	SwapLimit                     bool
-	CpuCfsPeriod           bool
+	CpuCfsPeriod                  bool
-	CpuCfsQuota            bool
+	CpuCfsQuota                   bool
-	IPv4ForwardingDisabled bool
+	IPv4ForwardingDisabled        bool
-	AppArmor               bool
+	AppArmor                      bool
-	OomKillDisable         bool
+	OomKillDisable                bool
+	BridgeNfCallIptablesDisabled  bool
+	BridgeNfCallIp6tablesDisabled bool
 }

pkg/sysinfo/sysinfo_linux.go

@@ -63,6 +63,21 @@ func New(quiet bool) *SysInfo {
 		}
 	}
 
+	// Check if bridge-nf-call-iptables is disabled.
+	if data, err := ioutil.ReadFile("/proc/sys/net/bridge/bridge-nf-call-iptables"); os.IsNotExist(err) {
+		sysInfo.BridgeNfCallIptablesDisabled = true
+	} else {
+		enabled, _ := strconv.Atoi(strings.TrimSpace(string(data)))
+		sysInfo.BridgeNfCallIptablesDisabled = enabled == 0
+	}
+	// Check if bridge-nf-call-ip6tables is disabled.
+	if data, err := ioutil.ReadFile("/proc/sys/net/bridge/bridge-nf-call-ip6tables"); os.IsNotExist(err) {
+		sysInfo.BridgeNfCallIp6tablesDisabled = true
+	} else {
+		enabled, _ := strconv.Atoi(strings.TrimSpace(string(data)))
+		sysInfo.BridgeNfCallIp6tablesDisabled = enabled == 0
+	}
+
 	// Check if AppArmor is supported.
 	if _, err := os.Stat("/sys/kernel/security/apparmor"); os.IsNotExist(err) {
 		sysInfo.AppArmor = false