fix: validate Docker IPv4 forwarding (#13820)

agent/app/service/docker.go

@@ -18,6 +18,7 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/common"
 	"github.com/1Panel-dev/1Panel/agent/utils/controller"
 	"github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"github.com/1Panel-dev/1Panel/agent/utils/firewall/docker_guard"
 )
 
 const dockerNftablesMinVersion = "29.0.0"
@@ -82,6 +83,11 @@ func (u *DockerService) UpdateFirewallBackend(backend string) error {
 	if backend == constant.FirewallProviderNftables && !dockerNftablesSupported(version) {
 		return fmt.Errorf("Docker Engine %s or later is required for the nftables firewall backend", dockerNftablesMinVersion)
 	}
+	if backend == constant.FirewallProviderNftables {
+		if err := docker_guard.CheckIPv4Forwarding(); err != nil {
+			return err
+		}
+	}
 
 	original, readErr := os.ReadFile(constant.DaemonJsonPath)
 	existed := readErr == nil

agent/utils/firewall/docker_guard/ip_forward.go

@@ -0,0 +1,27 @@
+package docker_guard
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+)
+
+const ipv4ForwardingPath = "/proc/sys/net/ipv4/ip_forward"
+
+var ErrIPv4ForwardingDisabled = errors.New("IPv4 forwarding is disabled; set net.ipv4.ip_forward=1 before using Docker's firewall backend")
+
+func CheckIPv4Forwarding() error {
+	return checkIPv4Forwarding(os.ReadFile)
+}
+
+func checkIPv4Forwarding(readFile func(string) ([]byte, error)) error {
+	value, err := readFile(ipv4ForwardingPath)
+	if err != nil {
+		return fmt.Errorf("inspect IPv4 forwarding: %w", err)
+	}
+	if strings.TrimSpace(string(value)) != "1" {
+		return ErrIPv4ForwardingDisabled
+	}
+	return nil
+}

agent/utils/firewall/docker_guard/manager.go

@@ -133,6 +133,9 @@ func NewManager() *Manager { return &Manager{runner: commandRunner{}} }
 func (m *Manager) Initialize(policies []Policy) error {
 	mutationMu.Lock()
 	defer mutationMu.Unlock()
+	if err := CheckIPv4Forwarding(); err != nil {
+		return err
+	}
 	inventory, err := m.ListPolicies()
 	if err != nil {
 		return err

agent/utils/firewall/docker_guard/nftables.go

@@ -30,6 +30,9 @@ func (m *NftablesManager) Initialize(policies []Policy) error {
 	if !m.runner.Exists("nft") {
 		return errors.New("nft is not installed")
 	}
+	if err := CheckIPv4Forwarding(); err != nil {
+		return err
+	}
 	if err := m.checkForwardPolicy(); err != nil {
 		return err
 	}