DOCKER-USER iptables chain missing after server restart when bridge=none

[bj-k]

• This is a bug report
• This is a feature request
• I searched existing issues before opening this one

Expected behavior

The DOCKER-USER iptables chain should be created after a server restart when daemon.json contains "bridge": "none".

Actual behavior

The DOCKER-USER iptables chain is missing. Only DOCKER-ISOLATION-STAGE-1 and DOCKER-ISOLATION-STAGE-2 is being created after a server restart.

Steps to reproduce the behavior

1. Install docker-ce 19.03.13 on CentOS 7 and enable SystemD service
2. Configure /etc/docker/daemon:

        {
            "bridge": "none"
        }
   

3. Restart server.
4. DOCKER-USER iptables chain is missing:

        [root@localhost ~]# iptables -S                                                                                                                                                                           
        -P INPUT ACCEPT                                                                                                                                                                                                                   
        -P FORWARD DROP                                                                                                                                                                                           
        -P OUTPUT ACCEPT                                                                                                                                                                                          
        -N DOCKER                                                                                                                                                                                                 
        -N DOCKER-ISOLATION-STAGE-1                                                                                                                                                                               
        -N DOCKER-ISOLATION-STAGE-2                                                                                                                                                                               
        -A DOCKER-ISOLATION-STAGE-1 -j RETURN                                                                                                                                                                     
        -A DOCKER-ISOLATION-STAGE-2 -j RETURN

5. Create new Docker network: docker network create my-network
6. DOCKER-USER chain has been created:

        [root@localhost ~]# iptables -S                                                                                                                                                                           
        -P INPUT ACCEPT                                                                                                                                                                                           
        -P FORWARD DROP                                                                                                                                                                                           
        -P OUTPUT ACCEPT                                                                                                                                                                                          
        -N DOCKER                                                                                                                                                                                                 
        -N DOCKER-ISOLATION-STAGE-1                                                                                                                                                                               
        -N DOCKER-ISOLATION-STAGE-2                                                                                                                                                                               
        -N DOCKER-USER                                                                                                                                                                                            
        -A FORWARD -j DOCKER-USER                                                                                                                                                                                 
        -A FORWARD -j DOCKER-ISOLATION-STAGE-1
        ...

(7. Reboot again to loose the DOCKER-USER chain...)

Output of docker version:

        Client: Docker Engine - Community
         Version:           19.03.13
         API version:       1.40
         Go version:        go1.13.15
         Git commit:        4484c46d9d
         Built:             Wed Sep 16 17:03:45 2020
         OS/Arch:           linux/amd64
         Experimental:      false
        
        Server: Docker Engine - Community
         Engine:
          Version:          19.03.13
          API version:      1.40 (minimum version 1.12)
          Go version:       go1.13.15
          Git commit:       4484c46d9d
          Built:            Wed Sep 16 17:02:21 2020
          OS/Arch:          linux/amd64
          Experimental:     false
         containerd:
          Version:          1.3.7
          GitCommit:        8fba4e9a7d01810a393d5d25a3621dc101981175
         runc:
          Version:          1.0.0-rc10
          GitCommit:        dc9208a3303feef5b3839f4323d9beb36df0a9dd
         docker-init:
          Version:          0.18.0
          GitCommit:        fec3683

Output of docker info:

        Client:
         Debug Mode: false
        
        Server:
         Containers: 0
          Running: 0
          Paused: 0
          Stopped: 0
         Images: 1
         Server Version: 19.03.13
         Storage Driver: overlay2
          Backing Filesystem: xfs
          Supports d_type: true
          Native Overlay Diff: true
         Logging Driver: json-file
         Cgroup Driver: cgroupfs
         Plugins:
          Volume: local
          Network: bridge host ipvlan macvlan null overlay
          Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
         Swarm: inactive
         Runtimes: runc
         Default Runtime: runc
         Init Binary: docker-init
         containerd version: 8fba4e9a7d01810a393d5d25a3621dc101981175
         runc version: dc9208a3303feef5b3839f4323d9beb36df0a9dd
         init version: fec3683
         Security Options:
          seccomp
           Profile: default
         Kernel Version: 3.10.0-1127.el7.x86_64
         Operating System: CentOS Linux 7 (Core)
         OSType: linux
         Architecture: x86_64
         CPUs: 1
         Total Memory: 487MiB
         Name: localhost.localdomain
         ID: QDT5:FQPM:4JF7:AZTU:H24E:6WRV:47OY:XPPV:UVLM:YZBW:IDKD:6HC4
         Docker Root Dir: /var/lib/docker
         Debug Mode: false
         Registry: https://index.docker.io/v1/
         Labels:
         Experimental: false
         Insecure Registries:
          127.0.0.0/8
         Live Restore Enabled: false
        
        WARNING: bridge-nf-call-iptables is disabled
        WARNING: bridge-nf-call-ip6tables is disabled

Additional environment details (AWS, VirtualBox, physical, etc.)

Reproduced with

• VMWare ESX
• VirtualBox (Vagrant)

        config.vm.box = "centos/7"
        config.vm.box_version = "2004.01"