fix: clean up unused iptables chains not being deleted on container r…

[haytok]

…emoval

When publishing a container's port(s) to the host and removeing the container, there are some iptables chains that are not deleted, as shown below:

$ sudo nerdctl run -d --name nginx -p 8080:80 nginx
81cc6b08527975ef8bf151b1460ead6a3d767310a7513d306a4bbe19f61fe6a8

$ ID=$(echo -n "bridgedefault-$(sudo nerdctl ps -q --no-trunc --filter=name=nginx)" | sha512sum | awk '{print substr($1, 1, 24)}')

$ sudo iptables -t nat -S | grep $ID
-N CNI-5e9207ffbe238a4b386cd5bd
-A POSTROUTING -s 10.4.0.156/32 -m comment --comment "name: \"bridge\" id: \"default-81cc6b08527975ef8bf151b1460ead6a3d767310a7513d306a4bbe19f61fe6a8\"" -j CNI-5e9207ffbe238a4b386cd5bd
-A CNI-5e9207ffbe238a4b386cd5bd -d 10.4.0.0/24 -m comment --comment "name: \"bridge\" id: \"default-81cc6b08527975ef8bf151b1460ead6a3d767310a7513d306a4bbe19f61fe6a8\"" -j ACCEPT
-A CNI-5e9207ffbe238a4b386cd5bd ! -d 224.0.0.0/4 -m comment --comment "name: \"bridge\" id: \"default-81cc6b08527975ef8bf151b1460ead6a3d767310a7513d306a4bbe19f61fe6a8\"" -j MASQUERADE

$ sudo nerdctl rm -f nginx
nginx

$ sudo iptables -t nat -S | grep $ID
-N CNI-5e9207ffbe238a4b386cd5bd

$ sudo iptables -L -nv -t nat | grep $ID -3
Chain CNI-5cd4851e431cb9d7ef1a143b (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain CNI-5e9207ffbe238a4b386cd5bd (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain CNI-5fa88ae608b5a4cfbe76c33d (0 references)

Unused iptables chains should be deleted. Therefore, this PR makes a change so that the relevant iptables chains are deleted when a container is removed.

[haytok]

Checking the CI Logs, It appears that this fix has prevented builds when GOOS=freebsd is set.

haytok@lima-haytok:/Users/haytok/workspace/github.com/haytok/nerdctl$ GOOS=freebsd go build ./...
# github.com/containernetworking/plugins/pkg/netlinksafe
/home/haytok.linux/go/pkg/mod/github.com/containernetworking/plugins@v1.9.1/pkg/netlinksafe/netlink.go:58:42: undefined: netlink.ErrDumpInterrupted
/home/haytok.linux/go/pkg/mod/github.com/containernetworking/plugins@v1.9.1/pkg/netlinksafe/netlink.go:66:28: undefined: netlink.ErrDumpInterrupted
/home/haytok.linux/go/pkg/mod/github.com/containernetworking/plugins@v1.9.1/pkg/netlinksafe/netlink.go:159:40: undefined: nl.BridgeVlanInfo
/home/haytok.linux/go/pkg/mod/github.com/containernetworking/plugins@v1.9.1/pkg/netlinksafe/netlink.go:161:27: undefined: nl.BridgeVlanInfo
/home/haytok.linux/go/pkg/mod/github.com/containernetworking/plugins@v1.9.1/pkg/netlinksafe/netlink.go:163:23: undefined: netlink.BridgeVlanList
/home/haytok.linux/go/pkg/mod/github.com/containernetworking/plugins@v1.9.1/pkg/netlinksafe/netlink.go:196:24: undefined: netlink.QdiscList
/home/haytok.linux/go/pkg/mod/github.com/containernetworking/plugins@v1.9.1/pkg/netlinksafe/netlink.go:207:25: h.Handle.QdiscList undefined (type *netlink.Handle has no field or method QdiscList)
/home/haytok.linux/go/pkg/mod/github.com/containernetworking/plugins@v1.9.1/pkg/netlinksafe/netlink.go:218:27: undefined: netlink.LinkGetProtinfo
/home/haytok.linux/go/pkg/mod/github.com/containernetworking/plugins@v1.9.1/pkg/netlinksafe/netlink.go:229:28: h.Handle.LinkGetProtinfo undefined (type *netlink.Handle has no field or method LinkGetProtinfo)
/home/haytok.linux/go/pkg/mod/github.com/containernetworking/plugins@v1.9.1/pkg/netlinksafe/netlink.go:240:24: undefined: netlink.RuleListFiltered
/home/haytok.linux/go/pkg/mod/github.com/containernetworking/plugins@v1.9.1/pkg/netlinksafe/netlink.go:240:24: too many errors

So, I'm investigating workarounds.

[AkihiroSuda]

Failing

=== Failing tests ===
TestLogsFollowNoExtraneousLineFeed
TestLogsWithoutNewlineOrEOF
=====================

https://github.com/containerd/nerdctl/actions/runs/24197307638/job/71240723501?pr=4835

[haytok]

Thanks for checking and retrying CI.

Oh ... I tried running the process performed in CI locally as shown below, but I couldn't reproduce the issue. Since this fix and the failing test (TestLogsFollowNoExtraneousLineFeed and TestLogsWithoutNewlineOrEOF) shouldn't be related, it's still unclear why the CI is failing...

$ sudo nerdctl build \
    -t test-integration-rootless \
    --target test-integration-rootless .

$  sudo nerdctl run -t --rm --privileged test-integration-rootless \
      /test-integration-rootless.sh ./hack/test-integration.sh \
      -test.only-flaky=false \
      -test.target=nerdctl.gomodjail \
      '-test.run=TestLogsFollowNoExtraneousLineFeed\|TestLogsWithoutNewlineOrEOF'

$ sudo nerdctl run -t --rm --privileged test-integration-rootless \
      /test-integration-rootless.sh ./hack/test-integration.sh \
      -test.only-flaky=false \
      -test.target=nerdctl.gomodjail

I'll look into it further.