Potentially fix issue with boot ordering

[eseliger]

It seems that recently docker started to run after the iptables-restore command, which then fails because it depends on some things to be created by docker I think.

This might fix our immediate issue by loading the chain manually again after boot.

Test plan: We'll need to upgrade an instance to use this. But running it manually on a broken one does make it start the executor service afterwards.

[filiphaftek]

TY

[willdollman]

• What about the behaviour if starting netfilter-persistent succeeded at boot? I think it'll apply the rules twice.
• Do we have ipv6 rules to load as well?

My (untested) suggestion is:
systemctl is-active netfilter-persistent || systemctl start netfilter-persistent

netfilter-persistent is a oneshot service so systemctl starting it again will rerun it even if it's succeeded, and we'd apply the rules twice. I believe is-active will return true if the previous execution successfully run though.

[eseliger]

We don’t store any rules for v6 ourselves - so from the firecracker pov we don’t need them I believe.

Good question about the double loading, I assumed it was a safe thing to run again 😅

[eseliger]

@willdollman @filiphaftek where did we land on this? It seems that reloading the file is safe?

[filiphaftek]

@willdollman @filiphaftek where did we land on this? It seems that reloading the file is safe?

Yes, it works on Cloud and we see no issues.