Hi folks,
there are some issues with my Docker installation.
I’m running docker on the old NAS and trying to get as much as possible from it.
uname -a
No LSB modules are available.
Distributor ID: Debian
Description: Debian GNU/Linux 12 (bookworm)
Release: 12
Codename: bookworm
Linux N2350 6.17.7-mvebu-tld-1 #1 SMP PREEMPT Tue Nov 4 16:19:08 PST 2025 armv7l GNU/Linux
docker compose version
Docker Compose version v5.0.0
docker --version
Docker version 29.1.3, build f52814d
docker info
Client: Docker Engine - Community
Version: 29.1.3
Context: default
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc.)
Version: v0.30.1
Path: /usr/libexec/docker/cli-plugins/docker-buildx
compose: Docker Compose (Docker Inc.)
Version: v5.0.0
Path: /usr/libexec/docker/cli-plugins/docker-compose
model: Docker Model Runner (Docker Inc.)
Version: v1.0.6
Path: /usr/libexec/docker/cli-plugins/docker-model
Server:
Containers: 5
Running: 5
Paused: 0
Stopped: 0
Images: 6
Server Version: 29.1.3
Storage Driver: overlayfs
driver-type: io.containerd.snapshotter.v1
Logging Driver: json-file
Cgroup Driver: systemd
Cgroup Version: 2
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
CDI spec directories:
/etc/cdi
/var/run/cdi
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: dea7da592f5d1d2b7755e3a161be07f43fad8f75
runc version: v1.3.4-0-gd6d73eb8
init version: de40ad0
Security Options:
seccomp
Profile: builtin
cgroupns
Kernel Version: 6.17.7-mvebu-tld-1
Operating System: Debian GNU/Linux 12 (bookworm)
OSType: linux
Architecture: armv7l
CPUs: 2
Total Memory: 996.4MiB
Name: N2350
ID: 0e413624-6d20-4126-8241-f6694894a14d
Docker Root Dir: /mnt/hdd1_system_data/docker/docker
Debug Mode: false
Experimental: false
Insecure Registries:
::1/128
127.0.0.0/8
Live Restore Enabled: false
Firewall Backend: iptables
The problem is - It starts some containers but I don’t see any port forwarding records after “docker ps” command. These are 1st an 3rd containers (take a look at the output)
docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
7bf29db5ae0d ckulka/baikal:nginx "/docker-entrypoint.…" 2 days ago Up 12 hours baikal-calendar-container
4c756166f113 dontobi/motioneye.rpi:latest "/entrypoint.sh" 2 days ago Up 12 hours 127.0.0.1:40003->8765/tcp motioneye-container
af9b67a77f59 drakkan/sftpgo:edge-alpine "sftpgo serve" 2 days ago Up 12 hours sftpgo-webdav-container
a52f886a94ec emby/embyserver_arm32v7:latest "/init" 3 days ago Up 9 hours 0.0.0.0:7359->7359/udp, 8920/tcp, 0.0.0.0:1901->1900/udp, 127.0.0.1:40002->8096/tcp emby-server-container
89aef233ad8f simske/speedtest "docker-php-entrypoi…" 3 days ago Up 12 hours 127.0.0.1:40001->80/tcp librespeedtest-web-containe
As far as this is an old NAS, Debian works from the USB drive. The other staff have to use one of the HDDs.
So, I moved all Docker-related folders to HDD like this:
mkdir -p /mnt/hdd1_system_data/docker/docker
mkdir -p /mnt/hdd1_system_data/docker/containerd
docker stop $(docker ps -q) 2>/dev/null || true
systemctl stop docker docker.socket containerd
systemctl status docker | grep Active
systemctl status containerd | grep Active
chmod -R 711 /mnt/hdd1_system_data/docker
rsync -avxhP --info=progress2 /var/lib/docker.bak/ /mnt/hdd1_system_data/docker/docker
rsync -avxhP --info=progress2 /var/lib/containerd/ /mnt/hdd1_system_data/docker/containerd
ls -lah /mnt/hdd1_system_data/docker/docker
ls -lah /mnt/hdd1_system_data/docker/containerd
mv /var/lib/docker /var/lib/docker.bak
mv /var/lib/containerd /var/lib/containerd.bak
ls -lah /var/lib/docker
ls -lah /var/lib/containerd
addet to /etc/docker/daemon.json file
these path
{
"data-root": "/mnt/hdd1_system_data/docker/docker"
}
and reconfigured /etc/containerd/config.toml
like this
root = "/mnt/hdd1_system_data/docker/containerd"
Then
systemctl start docker docker.socket containerd
systemctl status docker docker.socket containerd
docker info | grep "Docker Root Dir"
inotifywait -m -r /mnt/hdd1_system_data/docker
and from what I can see from the last command, there is an activity in /mnt/hdd1_system_data/docker folder.
Next to is I used these commands to run my first container
docker network create -d bridge docker-net-baikal-calendasftpgor
mkdir -p /mnt/hdd1_system_data/docker_folders/baikal-calendar/data
mkdir -p /mnt/hdd1_system_data/docker_folders/baikal-calendar/config
docker run -itd \
--memory=100m \
--name baikal-calendar-container \
--network=docker-net-baikal-calendar \
-p 192.168.36.3:34278:80 \
-v /mnt/hdd1_system_data/docker_folders/baikal-calendar/data:/var/www/baikal/Specific \
-v /mnt/hdd1_system_data/docker_folders/baikal-calendar/config:/var/www/baikal/config \
--security-opt=no-new-privileges \
-e BAIKAL_DAV_REALM="Server" \
-e DISABLE_IPV6='true' \
--restart=always \
ckulka/baikal:nginx
and the second one
docker network create -d bridge docker-net-sftpgo-container
mkdir -p /mnt/hdd1_system_data/docker_folders/sftp-go/data/
mkdir -p /mnt/hdd1_system_data/docker_folders/sftp-go/home/
chown -R 1000:1000 /mnt/hdd1_system_data/docker_folders/sftp-go
docker run -d --name sftpgo-webdav-container \
--memory=50m \
--network=docker-net-sftpgo-container \
-p 192.168.36.3:34279:8080 \
-p 192.168.36.3:34280:2022 \
-p 192.168.36.3:34281:10080 \
-e SFTPGO_GRACE_TIME=15 \
-e SFTPGO_WEBDAVD__BINDINGS__0__PORT=10080 \
-e SFTPGO_WEBDAVD__BINDINGS__0__PREFIX=/dav2025 \
-v /mnt/hdd1_system_data/docker_folders/sftp-go/data:/srv/sftpgo \
-v /mnt/hdd1_system_data/docker_folders/sftp-go/home:/var/lib/sftpgo \
--security-opt=no-new-privileges \
--restart=unless-stopped \
"drakkan/sftpgo:edge-alpine"
Here are my current iptables rules
root@N2350:~# iptables-save
# Generated by iptables-save v1.8.9 (nf_tables) on Fri Jan 2 10:55:55 2026
*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -d 172.22.0.2/32 ! -i br-9b4bc4f13571 -j DROP
-A PREROUTING -d 172.18.0.2/32 ! -i br-0762af25aac5 -j DROP
-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 40003 -j DROP
-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 40001 -j DROP
-A PREROUTING -d 172.19.0.2/32 ! -i br-6e53f222c986 -j DROP
-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 40002 -j DROP
COMMIT
# Completed on Fri Jan 2 10:55:55 2026
# Generated by iptables-save v1.8.9 (nf_tables) on Fri Jan 2 10:55:55 2026
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:DOCKER - [0:0]
:DOCKER-BRIDGE - [0:0]
:DOCKER-CT - [0:0]
:DOCKER-FORWARD - [0:0]
:DOCKER-INTERNAL - [0:0]
:DOCKER-USER - [0:0]
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-FORWARD
-A DOCKER -d 172.19.0.2/32 ! -i br-6e53f222c986 -o br-6e53f222c986 -p tcp -m tcp --dport 8096 -j ACCEPT
-A DOCKER -d 172.19.0.2/32 ! -i br-6e53f222c986 -o br-6e53f222c986 -p udp -m udp --dport 7359 -j ACCEPT
-A DOCKER -d 172.19.0.2/32 ! -i br-6e53f222c986 -o br-6e53f222c986 -p udp -m udp --dport 1900 -j ACCEPT
-A DOCKER -d 172.18.0.2/32 ! -i br-0762af25aac5 -o br-0762af25aac5 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.22.0.2/32 ! -i br-9b4bc4f13571 -o br-9b4bc4f13571 -p tcp -m tcp --dport 8765 -j ACCEPT
-A DOCKER ! -i br-03009ff4f408 -o br-03009ff4f408 -j DROP
-A DOCKER ! -i br-0762af25aac5 -o br-0762af25aac5 -j DROP
-A DOCKER ! -i br-6e53f222c986 -o br-6e53f222c986 -j DROP
-A DOCKER ! -i br-9b4bc4f13571 -o br-9b4bc4f13571 -j DROP
-A DOCKER ! -i br-ce52591695f3 -o br-ce52591695f3 -j DROP
-A DOCKER ! -i docker0 -o docker0 -j DROP
-A DOCKER-BRIDGE -o br-03009ff4f408 -j DOCKER
-A DOCKER-BRIDGE -o br-0762af25aac5 -j DOCKER
-A DOCKER-BRIDGE -o br-6e53f222c986 -j DOCKER
-A DOCKER-BRIDGE -o br-9b4bc4f13571 -j DOCKER
-A DOCKER-BRIDGE -o br-ce52591695f3 -j DOCKER
-A DOCKER-BRIDGE -o docker0 -j DOCKER
-A DOCKER-CT -o br-03009ff4f408 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-CT -o br-0762af25aac5 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-CT -o br-6e53f222c986 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-CT -o br-9b4bc4f13571 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-CT -o br-ce52591695f3 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-CT -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-FORWARD -j DOCKER-CT
-A DOCKER-FORWARD -j DOCKER-INTERNAL
-A DOCKER-FORWARD -j DOCKER-BRIDGE
-A DOCKER-FORWARD -i br-03009ff4f408 -j ACCEPT
-A DOCKER-FORWARD -i br-0762af25aac5 -j ACCEPT
-A DOCKER-FORWARD -i br-6e53f222c986 -j ACCEPT
-A DOCKER-FORWARD -i br-9b4bc4f13571 -j ACCEPT
-A DOCKER-FORWARD -i br-ce52591695f3 -j ACCEPT
-A DOCKER-FORWARD -i docker0 -j ACCEPT
COMMIT
# Completed on Fri Jan 2 10:55:55 2026
# Generated by iptables-save v1.8.9 (nf_tables) on Fri Jan 2 10:55:55 2026
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:DOCKER - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -s 172.20.0.0/16 ! -o br-ce52591695f3 -j MASQUERADE
-A POSTROUTING -s 172.22.0.0/16 ! -o br-9b4bc4f13571 -j MASQUERADE
-A POSTROUTING -s 172.19.0.0/16 ! -o br-6e53f222c986 -j MASQUERADE
-A POSTROUTING -s 172.18.0.0/16 ! -o br-0762af25aac5 -j MASQUERADE
-A POSTROUTING -s 172.21.0.0/16 ! -o br-03009ff4f408 -j MASQUERADE
-A DOCKER -d 127.0.0.1/32 ! -i br-9b4bc4f13571 -p tcp -m tcp --dport 40003 -j DNAT --to-destination 172.22.0.2:8765
-A DOCKER -d 127.0.0.1/32 ! -i br-0762af25aac5 -p tcp -m tcp --dport 40001 -j DNAT --to-destination 172.18.0.2:80
-A DOCKER ! -i br-6e53f222c986 -p udp -m udp --dport 1901 -j DNAT --to-destination 172.19.0.2:1900
-A DOCKER ! -i br-6e53f222c986 -p udp -m udp --dport 7359 -j DNAT --to-destination 172.19.0.2:7359
-A DOCKER -d 127.0.0.1/32 ! -i br-6e53f222c986 -p tcp -m tcp --dport 40002 -j DNAT --to-destination 172.19.0.2:8096
COMMIT
# Completed on Fri Jan 2 10:55:55 2026
I tried to delete these 2 containers and run them again. And they work fine ONLY until NAS reboot, after that they are losing port forward options (as you can see from the “docker ps” output).
What I’ve tried during recent days:
I disabled iptables persistent option and disabled all the rules before Docker reinstallation.
I tried to reinstall OS and Docker (everything) from the scratch. But no luck.
Any ideas what also can I check?
Thanks in advance.