iptables chain DOCKER-USER for nat/POSTROUTING

[powerman]

Currently we've DOCKER-USER iptables chain, but this helps managing only filter/FORWARD chain, while there are other chains modified by docker

E.g. I'm running docker on a router, and I've several own records in nat/POSTROUTING chain with -j MASQUERADE and -j SNAT. Docker currently adds own rules both before and after my own rules, which makes updating own rules inconvenient and often result in needs to restart docker daemon after updating firewall rules.

I propose to add custom chains like DOCKER-USER also to nat/POSTROUTING, and probably to all other chains modified by docker (just in case, to solve this once and for all).

[IvMisticos]

The issue should be bumped as it can be used quite a lot by some and would be great to have.

[matthijskooijman]

It seems that #41163 is a duplicate of this issue (that issue also mentions PREROUTING in the title, but this issue mentions applying this for all chains modified by docker, making this issue the broader one.

and probably to all other chains modified by docker (just in case, to solve this once and for all).

Maybe it would even be good to add these chains to all default chains (even when they are not currently modified by docker), to prevent additional upgrade friction when docker is modified to add rules to other chains in the future.

Also note issue #42477, requesting a DOCKER-USER chain for ipv6 too.

I've just posted #44816 about docker adding rules directly to the main chains (e.g. FORWARD), not just its own chains (e.g. DOCKER), which is related to this issue (they should probably be solved together to make docker iptables behavior more predictable and interoperable).

Wrt to the subject of this issue, I wrote the following in that issue:

Similarly, the DOCKER-USER chain should be duplicate for each main rule, e.g. DOCKER-USER-INPUT, DOCKER-USER-FORWARD, etc. Or maybe it could be renamed to something more explicit like BEFORE-DOCKER-FORWARD to make the ordering more explicit (maybe also add AFTER-DOCKER-FORWARD for more control over ordering)?