dockerd: Update to 29.0.0

Signed-off-by: sbwml <admin@cooluc.com>

files/dockerd.init

@@ -153,7 +153,7 @@ ucidel() {
 }
 
 process_config() {
-	local alt_config_file data_root log_level iptables ip6tables bip
+	local alt_config_file data_root log_level nftables bip
 
 	[ -f /etc/config/dockerd ] || {
 		# Use the daemon default configuration
@@ -174,8 +174,7 @@ process_config() {
 
 	config_get data_root globals data_root "/opt/docker/"
 	config_get log_level globals log_level "warn"
-	config_get_bool iptables globals iptables "1"
-	config_get_bool ip6tables globals ip6tables "0"
+	config_get_bool nftables globals nftables "1"
 
 	# Don't add these options by default
 	# omission == docker defaults
@@ -200,8 +199,9 @@ process_config() {
 	json_init
 	json_add_string "data-root" "${data_root}"
 	json_add_string "log-level" "${log_level}"
-	json_add_boolean "iptables" "${iptables}"
-	json_add_boolean "ip6tables" "${ip6tables}"
+	[ "${nftables}" = "1" ] && {
+		json_add_string "firewall-backend" "nftables"
+	}
 	[ "${buildkit}" = "1" ] && {
 		json_add_object 'features'
 		json_add_boolean "buildkit" "${buildkit}"
@@ -232,8 +232,6 @@ process_config() {
 	fi
 	[ -z "${storage_driver}" ] || json_add_string "storage-driver" "${storage_driver}"
 	json_dump > "${DOCKERD_CONF}"
-
-	[ "${iptables}" -eq "1" ] && config_foreach iptables_add_blocking_rule firewall
 }
 
 start_service() {
@@ -261,49 +259,6 @@ service_triggers() {
 	procd_add_reload_trigger 'dockerd'
 }
 
-iptables_add_blocking_rule() {
-	local cfg="${1}"
-
-	local device=""
-	local extra_iptables_args=""
-
-	handle_iptables_rule() {
-		local interface="${1}"
-		local outbound="${2}"
-		local extra_iptables_args="${3}"
-
-		local inbound=""
-
-		. /lib/functions/network.sh
-		network_get_physdev inbound "${interface}"
-
-		[ -z "${inbound}" ] && {
-			logger -t "dockerd-init" -p notice "Unable to get physical device for interface ${interface}"
-			return
-		}
-
-		# Wait for a maximum of 10 second per command, retrying every millisecond
-		local iptables_wait_args="--wait 10 --wait-interval 1000"
-
-		# Ignore errors as it might already be present
-		iptables ${iptables_wait_args} --table filter --new DOCKER-USER 2>/dev/null
-		if ! iptables ${iptables_wait_args} --table filter --check DOCKER-USER --in-interface "${inbound}" --out-interface "${outbound}" ${extra_iptables_args} --jump REJECT 2>/dev/null; then
-			logger -t "dockerd-init" -p notice "Drop traffic from ${inbound} to ${outbound}"
-			iptables ${iptables_wait_args} --table filter --insert DOCKER-USER --in-interface "${inbound}" --out-interface "${outbound}" ${extra_iptables_args} --jump REJECT
-		fi
-	}
-
-	config_get device "${cfg}" device
-
-	[ -z "${device}" ] && {
-		logger -t "dockerd-init" -p notice "No device configured for ${cfg}"
-		return
-	}
-
-	config_get extra_iptables_args "${cfg}" extra_iptables_args
-	config_list_foreach "${cfg}" blocked_interfaces handle_iptables_rule "${device}" "${extra_iptables_args}"
-}
-
 stop_service() {
 	if /etc/init.d/dockerd running; then
 		service_stop "/usr/bin/dockerd"