With iptables and ip6tables disabled, the daemon doesn't manage firewall
rules for its bridge networks, but it still added each bridge to
firewalld's "docker" zone, whose target is ACCEPT. That replaced the
zone firewalld would otherwise apply to the bridge, so a user filtering
container traffic with firewalld had to bind each bridge to their own
zone. The firewalld reload handler already skips bridge networks in this
configuration.
Add the bridge to the "docker" zone only when iptables or ip6tables is
enabled. A zone applies to the whole interface, so with either one
enabled the bridge is in the zone for both address families.
Still remove the bridge from the zone when deleting a network, in case
it was added while iptables was enabled, but don't warn when it isn't
there.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Assisted-by: Claude Opus 5.5
Cory Snider
b67dafffdc