ERROR: NAME_CONFLICT: new_policy_object(): 'docker-forwarding'

rgpaiva · April 9, 2025, 2:12pm

Hello , I installed Docker on Fedora 41 and after using journalctl -p 3 -b , I saw only one error in the logs related to docker:

➜ ~ journalctl -p 3 -b
Apr 09 09:26:48 fedora kernel:
Apr 09 09:26:57 fedora firewalld[971]: ERROR: NAME_CONFLICT: new_policy_object(): ‘docker-forwarding’

Linux:

➜ ~ uname -a
Linux fedora 6.13.9-200.fc41.x86_64 #1 SMP PREEMPT_DYNAMIC Sat Mar 29 01:29:31 UTC 2025 x86_64 GNU/Linux

I didn’t had any issues installing the test image, so I really don’t know if I should just ignore this message or not.

Thanks in advance.

martinjrgsn · April 10, 2025, 4:57pm

I got the same error:

journalctl -p 3 -b
Apr 10 18:35:29 fedora-server kernel: 
Apr 10 18:35:39 fedora-server firewalld[1053]: ERROR: NAME_CONFLICT: new_policy_object(): 'docker-forwarding'

Linux

uname -a
Linux fedora-server 6.13.9-200.fc41.x86_64 #1 SMP PREEMPT_DYNAMIC Sat Mar 29 01:29:31 UTC 2025 x86_64 GNU/Linux

I’m not sure if this is helpful at all, but this is the data available from cockpit

firewalld
ERROR: NAME_CONFLICT: new_policy_object(): 'docker-forwarding'

PRIORITY
    3
SYSLOG_FACILITY
    3
SYSLOG_IDENTIFIER
    firewalld
SYSLOG_PID
    1053
SYSLOG_TIMESTAMP
    Apr 10 18:35:39 
_BOOT_ID
    c2641e3184cf436097951ba117161a3e
_CAP_EFFECTIVE
    1f3f5fdffff
_CMDLINE
    /usr/bin/python3 -sP /usr/sbin/firewalld --nofork --nopid
_COMM
    firewalld
_EXE
    /usr/bin/python3.13
_GID
    0
_HOSTNAME
    fedora-server
_MACHINE_ID
    0951c5a79d294a49a5e9c3242e20b4c3
_PID
    1053
_RUNTIME_SCOPE
    system
_SELINUX_CONTEXT
    system_u:system_r:firewalld_t:s0
_SOURCE_REALTIME_TIMESTAMP
    1744302939256479
_SYSTEMD_CGROUP
    /system.slice/firewalld.service
_SYSTEMD_INVOCATION_ID
    3c22a525fe794f6282be2800886fa126
_SYSTEMD_SLICE
    system.slice
_SYSTEMD_UNIT
    firewalld.service
_TRANSPORT
    syslog
_UID
    0
__CURSOR
    s=d5ad871b5c8b44e987c6c295bb547d42;i=121b9;b=c2641e3184cf436097951ba117161a3e;m=15dd5c7;t=6326f2d1336b8;x=50f3ffd1bbbe1d
__MONOTONIC_TIMESTAMP
    22926791
__REALTIME_TIMESTAMP
    1744302939256504
__SEQNUM
    74169
__SEQNUM_ID
    d5ad871b5c8b44e987c6c295bb547d42

I also get the following warnings:

April 10, 2025
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/ip6tables -w10 -t filter -X DOCKER-ISOLATION' failed: ip6tables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/ip6tables -w10 -t filter -F DOCKER-ISOLATION' failed: ip6tables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/ip6tables -w10 -t filter -X DOCKER-ISOLATION-STAGE-2' failed: ip6tables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/ip6tables -w10 -t filter -F DOCKER-ISOLATION-STAGE-2' failed: ip6tables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/ip6tables -w10 -t filter -X DOCKER-ISOLATION-STAGE-1' failed: ip6tables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/ip6tables -w10 -t filter -F DOCKER-ISOLATION-STAGE-1' failed: ip6tables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/ip6tables -w10 -t filter -X DOCKER' failed: ip6tables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/ip6tables -w10 -t filter -F DOCKER' failed: ip6tables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/ip6tables -w10 -t nat -X DOCKER' failed: ip6tables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/ip6tables -w10 -t nat -F DOCKER' failed: ip6tables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/ip6tables -w10 -t nat -D OUTPUT' failed: ip6tables: Bad rule (does a matching rule exist in that chain?).
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/ip6tables -w10 -t nat -D PREROUTING' failed: ip6tables: Bad rule (does a matching rule exist in that chain?).
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/ip6tables -w10 -t nat -D OUTPUT -m addrtype --dst-type LOCAL -j DOCKER' failed: ip6tables v1.8.10 (nf_tables): Chain 'DOCKER' does not exist Try `ip6tables -h' or 'ip6tables --help' for more information.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/ip6tables -w10 -t nat -D OUTPUT -m addrtype --dst-type LOCAL ! --dst ::1/128 -j DOCKER' failed: ip6tables v1.8.10 (nf_tables): Chain 'DOCKER' does not exist Try `ip6tables -h' or 'ip6tables --help' for more information.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/ip6tables -w10 -t nat -D PREROUTING -m addrtype --dst-type LOCAL -j DOCKER' failed: ip6tables v1.8.10 (nf_tables): Chain 'DOCKER' does not exist Try `ip6tables -h' or 'ip6tables --help' for more information.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER-ISOLATION' failed: iptables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER-ISOLATION' failed: iptables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER-ISOLATION-STAGE-2' failed: iptables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER-ISOLATION-STAGE-2' failed: iptables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER-ISOLATION-STAGE-1' failed: iptables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER-ISOLATION-STAGE-1' failed: iptables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER' failed: iptables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER' failed: iptables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -X DOCKER' failed: iptables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -F DOCKER' failed: iptables: No chain/target/match by that name.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D OUTPUT' failed: iptables: Bad rule (does a matching rule exist in that chain?).
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D PREROUTING' failed: iptables: Bad rule (does a matching rule exist in that chain?).
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D OUTPUT -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables v1.8.10 (nf_tables): Chain 'DOCKER' does not exist Try `iptables -h' or 'iptables --help' for more information.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D OUTPUT -m addrtype --dst-type LOCAL ! --dst 127.0.0.0/8 -j DOCKER' failed: iptables v1.8.10 (nf_tables): Chain 'DOCKER' does not exist Try `iptables -h' or 'iptables --help' for more information.
firewalld
6:35 PM
WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -D PREROUTING -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables v1.8.10 (nf_tables): Chain 'DOCKER' does not exist Try `iptables -h' or 'iptables --help' for more information.
firewalld
6:35 PM
ERROR: NAME_CONFLICT: new_policy_object(): 'docker-forwarding'
firewalld
6:35 PM
Started firewalld.service - firewalld - dynamic firewall daemon.
systemd
6:35 PM
Starting firewalld.service - firewalld - dynamic firewall daemon...
systemd

journalctl -u docker.service
-- Boot c2641e3184cf436097951ba117161a3e --
Apr 10 18:35:37 fedora-server systemd[1]: Starting docker.service - Docker Application Container Engine...
Apr 10 18:35:38 fedora-server dockerd[1238]: time="2025-04-10T18:35:38.488817400+02:00" level=info msg="Starting up"
Apr 10 18:35:38 fedora-server dockerd[1238]: time="2025-04-10T18:35:38.509557073+02:00" level=info msg="detected 127.0.0.53 nameserv>
Apr 10 18:35:39 fedora-server dockerd[1238]: time="2025-04-10T18:35:39.037314847+02:00" level=info msg="[graphdriver] using prior st>
Apr 10 18:35:39 fedora-server dockerd[1238]: time="2025-04-10T18:35:39.152299690+02:00" level=info msg="Loading containers: start."
Apr 10 18:35:39 fedora-server dockerd[1238]: time="2025-04-10T18:35:39.233731075+02:00" level=info msg="Firewalld: docker zone alrea>
Apr 10 18:35:39 fedora-server dockerd[1238]: time="2025-04-10T18:35:39.716509815+02:00" level=info msg="Firewalld: interface docker0>
Apr 10 18:35:39 fedora-server dockerd[1238]: time="2025-04-10T18:35:39.860807601+02:00" level=info msg="Firewalld: interface br-d4fd>
Apr 10 18:35:40 fedora-server dockerd[1238]: time="2025-04-10T18:35:40.413314013+02:00" level=info msg="Default bridge (docker0) is >
Apr 10 18:35:40 fedora-server dockerd[1238]: time="2025-04-10T18:35:40.580036957+02:00" level=info msg="Firewalld: interface docker0>
Apr 10 18:35:40 fedora-server dockerd[1238]: time="2025-04-10T18:35:40.911278081+02:00" level=info msg="No non-localhost DNS nameser>
Apr 10 18:35:42 fedora-server dockerd[1238]: time="2025-04-10T18:35:42.031838341+02:00" level=info msg="Loading containers: done."
Apr 10 18:35:42 fedora-server dockerd[1238]: time="2025-04-10T18:35:42.061337952+02:00" level=warning msg="WARNING: bridge-nf-call-i>
Apr 10 18:35:42 fedora-server dockerd[1238]: time="2025-04-10T18:35:42.061380526+02:00" level=warning msg="WARNING: bridge-nf-call-i>
Apr 10 18:35:42 fedora-server dockerd[1238]: time="2025-04-10T18:35:42.061421396+02:00" level=info msg="Docker daemon" commit=2.fc41>
Apr 10 18:35:42 fedora-server dockerd[1238]: time="2025-04-10T18:35:42.061625444+02:00" level=info msg="Daemon has completed initial>
Apr 10 18:35:42 fedora-server dockerd[1238]: time="2025-04-10T18:35:42.525920312+02:00" level=info msg="API listen on /run/docker.so>
Apr 10 18:35:42 fedora-server systemd[1]: Started docker.service - Docker Application Container Engine.

rimelek · April 11, 2025, 11:29pm

Interestingly, we got multiple similar reports recently. You can try to report it also where the developers cans ee

You shared mostly the beginning of the lines. If you want to share the whole lines, you can disable the pager

journalctl -u docker.service --no-pager

Topic		Replies	Views
[debian] daemon fails to start: NAME_CONFLICT: new_policy_object(): 'docker-forwarding' General	0	1135	July 22, 2024
Error message in log General	0	650	April 14, 2020
Docker help needed DevopsForum.info General docker	0	715	June 15, 2018
Docker 24.0.7 and dind 24.0.7 unable to update ubuntu images. Temporary failure resolving 'archive.ubuntu.com' General	12	2183	December 31, 2023
Error namespace in logs at reboot in Ubuntu for docker container General docker	0	485	September 4, 2019

ERROR: NAME_CONFLICT: new_policy_object(): 'docker-forwarding'

Related topics