Avoid quadratic behavior in pathological label-alias case in MachBuffer.

Fixes #3468.
If a program has many instances of the pattern "goto next; next:" in a
row (i.e., no-op branches to the fallthrough address), the branch
simplification in MachBuffer would remove them all, as expected.
However, in order to work correctly, the algorithm needs to track all
labels that alias the current buffer tail, so that they can be adjusted
later if another branch chomp occurs.
When many thousands of this branch-to-next pattern occur, many thousands
of labels will reference the current buffer tail, and this list of
thousands of labels will be shuffled between the branch metadata struct
and the "labels at tail" struct as branches are appended and then
chomped immediately.
It's possible that with smarter data structure design, we could somehow
share the list of labels -- e.g., a single array of all labels, in order
they are bound, with ranges of indices in this array used to represent
lists of labels (actually, that seems like a better design in general);
but let's leave that to future optimization work.
For now, we can avoid the quadratic behavior by just "giving up" if the
list is too long; it's always valid to not optimize a branch. It is very
unlikely that the "normal" case will have more than 100 "goto next"
branches in a row, so this should not have any perf impact; if it does,
we will leave 1 out of every 100 such branches un-optimized in a long
sequence of thousands.
This takes total compilation time down on my machine from ~300ms to
~72ms for the foo.wasm case in #3441. For reference, the old backend
(now removed), built from arbitrarily-chosen-1-year-old commit
c7fcc344, takes 158ms, so we're ~twice as fast, which is what I would
expect.
(This PR also switches a few statics to consts just above where I added
a const, as s drive-by change.)

Out of further curiosity, even 70ms for a function like this seems somewhat high, is that still due to MachBuffer things or is it general "too much elbow grease is needed to bring that down further"

I think it is mostly in the middle-end (analyses and optimizations), which will see the huge CFG with all the loops before it's reduced. The backend stages that are specifically broken out in the clif-util wasm -T output show: 3ms in CLIF -> VCode lowering; 4ms in regalloc; and 4ms in binary emission (MachBuffer + cpu-specific instruction encoding code). So only 10ms in the "backend" and the rest in attempted optimization.
A perf profile of the compilation shows a lot of time in the kernel's pagefault path, so I think that just writing out the data structures has some overhead (for the large function body). I imagine we could probably be smarter about early optimizations that cut down the amount of work the later stages have to do; but nothing immediately obviously or anomalously bad is happening here, I think.


When editing a cluster as yaml cursor does not reflect actual position

What kind of request is this (question/bug/enhancement/feature request):
Bug
Steps to reproduce (least amount of steps as possible):
Edit a cluster as yaml.
I've noticed it seems to happen when the addons section and maybe a few others get squashed into a single line.
Today we logged this issue on two computers running Chrome on windows 10
Here we have merely opened a cluster yaml in the UI and scrolled down to a spot where we can safely screen cap without exposing anything sensitive.  In the first shot, you see where the cursor appears to be, and in the second we type the single character x, but it appears on the line below.  The cursor corrects its position and we can see where it actually is.  In this session, we went on to remove 3 lines and after removing the first, the cursor went back to appearing in the wrong place, but this time experienced an offset of 2 lines until after we removed the 3rd line and saved the manifest (no screenshots).

I will flesh out the ticket with more information when I can get it from the customer on another call.
Rancher v2.2.9 and v2.3.5
gz#9812

I have not been able to reproduce this in Chrome or Firefox on Mac. I asked Cody to test on his windows box with chrome (Version 83.0.4103.61 (Official Build) (64-bit)) and he was unable to reproduce as well. What version of rancher was used? Did you try repeating the same action in a private browsing window so no extensions are interfering?

We followed up in private back in May, but the customer has tested on v2.2.9 and v2.3.5 and we have tested with all extensions disabled.

@westlywright What information are we waiting on here?


Remove ChunkStore backpressure mechanism

This was something that evolved from the way that Dynamo stores
data, and a way to allow clients to make incremental write
progress. We never actually made the clients handle it
properly, though, and so much has changed since we wrote it
that it's only going to be in the way of building something
better.
Fixes #3234

PTAL. It turns out that the new testify handles nil pointers to custom error types differently, for some reason. This caused a bunch of tests that checked the return value of PutMany() to fail. So, since Raf and I agreed we want to get rid of BackpressureError anyway, I just did that :-)
PTAL
fyi @rafael-atticlabs

\o/


Allow callers to define PARQUET_ARROW_VERSION

Hi! This is the friendly automated conda-forge-linting service.
I just wanted to let you know that I linted all conda-recipes in your PR (recipe) and found it was in an excellent condition.


Add warning message before test runs - production data pruned

Hi,
I've just checked out the repo so I could contribute, ran the tests and had 53 failures without touching the code. The rspec output showed always the same error, saying that there was a missing TEST_API_USER and TEST_API_KEY ENV variable so I went to the librato UI of my production account and created a new token for testing and passed this token to the rspec run. The tests started to run and I've noticed a decline in my production metrics in librato UI.
Unfortunately, the test run deleted all my production metrics within seconds due to this line: https://github.com/librato/librato-metrics/blob/727268d4ffd86b183c7c20b1d5861f491689657c/spec/spec_helper.rb#L20
This is really frustrating and it just doesn't look right to me that this can happen at all and that no TEST environment has been evaluated prior to deleting the metrics.
Shouldn't there be at least a big warning sign on the public github repo warning devs about running this in their non-test accounts ? Or even stating that there's a need for an extra test account in order to run the tests would have saved me. One could also include a warning box in spec_helper that runs in a before(:suite) hook with a sleep of 10 seconds so people have a chance to ctrl-c the run ? I wasn't aware of the consequences at all and I would like others to not nuke their production data like I did by running the simple command:
bundle exec rspec
IMHO, this is really not how it should work.

@standardout - You are absolutely correct. This definitely isn't how it should work. We typically run tests with rake which automatically skips these tests if an account isn't specified. Historically the integration tests exist primarily for internal use.
By running with rspec directly (a very reasonable action) it looks like you ran into the errors produced by the tests that would normally be skipped with rake. It looks like the possibility of doing this was introduced when we upgraded rspec in the last month, as the default runner behavior has changed.
My profound apologies that this was even possible and that your data was affected. I know our support team is working now to restore the affected data. I believe they are already in contact with you but if not or if you need additional information you can reach them at<EMAIL_ADDRESS>or via the in-app help.
We will also add additional safeguards in this library to make sure this doesn't happen again. Apologies again and we appreciate your patience as we get your data restored.

Hi @nextmat ,
your support team is doing a great job, more and more of my data is showing up again! 👍
Thanks for the explanation what went wrong. For now, I'll create a separate librato test account for running my local tests.

@standardout - Happy to hear it! Apologies again for the trouble & thank you for helping to improve the library.

@standardout - One other side note that might be useful: because of small delays in given eventual consistency at our current scale we've been seeing more flapping in our integration suite recently. We've been exploring moving to testing these differently but if you see some inconsistent failures this the likely cause.


Error with 1-d model

Hi,
I'm trying to convert a model trained on MNIST in caffe. The conversion to tensorflow is raising an error. The conversion utility is missing the number of channels param for the first Convolution layer. Instead of reading the 4d array as (64, 1, 5, 5) for Conv1 layer, it only recognizes the params as a 3d array viz., (64, 5, 5). Can you pls help me.
Regards

I've pushed a new version which should fix the issues with the FC layer.
Note that these issues are restricted to the protobuf backend only. Everything should already work correctly with the PyCaffe backend.

I've pushed a new version which should fix the issues with the FC layer.
Note that these issues are restricted to the protobuf backend only. Everything should already work correctly with the PyCaffe backend.

Yes, that worked like a charm. Happy new year to you.
Regards

Yes, that worked like a charm. Happy new year to you.
Regards


[PathProvider] Get access to "external" cache directory on Android

Currently PathProvider on Android provides access only to folder returned by getCacheDir(). However this folder is limited to 1MB. However for average application it is not enough to cache some data.  According to documentation:

if your app requires a larger cache (larger than 1 MB), you should use getExternalCacheDir() instead.
https://developer.android.com/reference/android/content/Context.html#getCacheDir()

So it would be nice to have access to "external cache dir" additionally.

For now you can expose that path via your own HostMessages/plugin.

@eseidelGoogle Would this be possible to add to use in cache_manager library?

I don't know what you're asking @jaggs6.  What's cache_manager?  https://pub.dartlang.org/packages/flutter_cache_manager

This was added quite a while ago in https://github.com/flutter/plugins/pull/2049, but wasn't associated with this issue so didn't close it out.


How to uninstall?

How do I uninstall after running setup and installing?

just delete the folder

You'll also want to stop and remove wyoming-*.service files from /etc/systemd/system

Oops, my bad sorry for the wrong advice...
@synesthesiam would it make sense to include an uninstall.sh script (or an equivalent python version?)
Something like
#!/bin/bash

cd /etc/systemd/system

for service in wyoming-*.service; do
    if [ -f "$service" ]; then
        echo "Stopping and disabling $service..."
        systemctl stop "$service"
        systemctl disable "$service"
        echo "Deleting $service from /etc/systemd/system..."
        rm -f "$service"
    else
        echo "No services found"
        break
    fi
done

systemctl daemon-reload
echo "Wyoming Satellite was uninstalled. You may delete this folder."


JS runtime error while inspecting memtrace

Happy to provide the corresponding trace.

This appears to be a regression -- the issue is not present in v0.15.0

Happy to provide the corresponding trace.

Yeah, if you want to attach the trace here, or email it to me at<EMAIL_ADDRESS>I can have a look, thanks. Sadly the backtrace alone won't tell us much

Thanks. I didn't know about the repo!
Unfortunately, it doesn't seem to compile in my 5.1.1 or 4.14.1 switches:
#=== ERROR while compiling js_of_ocaml_patches.v0.17~preview.129.17+77 ========#
# context     2.1.5 | macos/arm64 | ocaml-base-compiler.4.14.1 | git+https://github.com/janestreet/opam-repository.git
# path        ~/.opam/4.14.1/.opam-switch/build/js_of_ocaml_patches.v0.17~preview.129.17+77
# command     ~/.opam/opam-init/hooks/sandbox.sh build dune build -p js_of_ocaml_patches -j 11
# exit-code   1
# env-file    ~/.opam/log/js_of_ocaml_patches-2169-341334.env
# output-file ~/.opam/log/js_of_ocaml_patches-2169-341334.out
### output ###
# Error: The method ellipse has type
# [...]
#        but is expected to have type
#          Js_of_ocaml__.Js.number_t ->
#          Js_of_ocaml__.Js.number_t ->
#          Js_of_ocaml__.Js.number_t ->
#          Js_of_ocaml__.Js.number_t ->
#          Js_of_ocaml__.Js.number_t ->
#          Js_of_ocaml__.Js.number_t ->
#          Js_of_ocaml__.Js.number_t ->
#          bool Js_of_ocaml__.Js.t -> unit Js_of_ocaml__.Js.meth
#        Type unit Js_of_ocaml.Js.meth is not compatible with type
#          bool Js_of_ocaml__.Js.t -> unit Js_of_ocaml__.Js.meth

#=== ERROR while compiling base.v0.17~preview.129.17+77 =======================#
# context     2.1.5 | macos/arm64 | ocaml-base-compiler.4.14.1 | git+https://github.com/janestreet/opam-repository.git
# path        ~/.opam/4.14.1/.opam-switch/build/base.v0.17~preview.129.17+77
# command     ~/.opam/opam-init/hooks/sandbox.sh build dune build -p base -j 11
# exit-code   1
# env-file    ~/.opam/log/base-2169-b5b8b3.env
# output-file ~/.opam/log/base-2169-b5b8b3.out
### output ###
# [...]
# 37 |     with module Array := Shadow_stdlib.Array
# ...
# 40 |     with module Buffer := Shadow_stdlib.Buffer
# 41 |     with module Bytes := Shadow_stdlib.Bytes
# 42 |     with module Char := Shadow_stdlib.Char
# 43 |     with module Condition := Shadow_stdlib.Condition
# Error: Unbound module Shadow_stdlib.Condition
# (cd _build/default && /Users/toots/.opam/4.14.1/bin/ocamlopt.opt -w -40 -g -I src/.base.objs/byte -I src/.base.objs/native -I /Users/toots/.opam/4.14.1/lib/ocaml_intrinsics_kernel -I /Users/toots/.opam/4.14.1/lib/sexplib0 -I hash_types/src/.base_internalhash_types.objs/byte -I hash_types/src/.base_internalhash_types.objs/native -I shadow-stdlib/src/.shadow_stdlib.objs/byte -I shadow-stdlib/sr[...]
# File "src/array.ml", line 399, characters 28-75:
# 399 |       result := Bool.select ((keep_left_if [@inlined]) (compare x !result)) x !result
#                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# Warning 55 [inlining-impossible]: Cannot inline: Unknown function

Any pointer as to how to compile it? A specific OCaml version perhaps?

Hmm ... 4.14 should work, I would think. Actually, I'm told the fix for memtrace-viewer might not be out in bleeding after all quite yet. There should be a roll of bleeding later today, so worth trying again when that happens.

Hi! The js_of_ocaml_patches error looks like your version of js_of_ocaml does not match the one we test against (5.6.0). Could you provide yours so we can update the version bounds on the package?
The bleeding edge version of Base requires 5.1, so it's expected that 4.14 fails.

Ok I was able to install in a vanilla 5.1.1 switch! The latest memtrace_viewer is missing a dep on codicons though.
I am able to confirm that the issue is fixed in version v0.17~preview.129.17+77.
I was using version 5.6.0 of js_of_ocaml..
Thanks for the help!


New Georeferences fields Required for New Collecting Event Task

For the cases in which the georeferences of a collecting event are created afterwards, we need three more Darwin Core fields so that the appropriate information is captured. These are: georeferencedBy, georeferencedDate, georeferenceProtocol

These fields are essential to be able to record all the necessary data. In the Specify software that we have been using for the MLP Enotmology Collection, we have them. We need to have them in TW also to migrate the information and to continue digitizing.

Besides adding those DwC fields as CollectingEvent custom attributes, would perhaps be possible to support them natively?

Besides adding those DwC fields as CollectingEvent custom attributes, would perhaps be possible to support them natively?

All doable.
Some are being exported in the dwc_fields branch by inferrrence already.
The remainder are largely done by adding Attribution to Georeference.
On Wed, Jun 16, 2021 at 11:50 AM mabecabrera @.***>
wrote:

Besides adding those DwC fields as CollectingEvent custom attributes,
would perhaps be possible to support them natively?
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/SpeciesFileGroup/taxonworks/issues/2285#issuecomment-862544428,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAAFQSD6TY7YIRKN5YJ7TGTTTDI6FANCNFSM45UUIHKQ
.

@jlpereira which of these requested fields have been added please?

@debpaul Date fields are already present for Georeferences. Protocol and Verifier(people) are in radial annotator

I think this is closable?

@mabecabrera do you have what you need (fields?) now?

Closing as done.


[zh] fix expiration of bound SA tokens

en PR: https://github.com/kubernetes/website/pull/29762
This fixes token expiration to be in sync with kubernetes/kubernetes#89549
https://github.com/kubernetes/website/pull/29762#issuecomment-924074318
This file has been synchronized for any other changes.

/lgtm
/approve


Examples: Twisted import error, broken?

Versions

Python: 3.5
OS: Win8.1, 64bit
Kivy: master, wheels

Description
Twisted example broken

ImportError: cannot import name '_threadedselect'

can't test on py2 as I don't have the old compiler. Maybe this is just a result of bad py3 compilation? (pip install twisted)

Confirmed, on OS X, python 3.6

This mostly cause the interface in twisted _threadselect is not yet ported to python3. This has been broken with Python3.x since the start then.
I would not call this bug a show stopper cause of this. Retagging for 2.0

Duplicate of https://github.com/kivy/kivy/issues/4275.


Exporting model to onnx format

How to export model to onnx format?
I tried the following with colab demo code , but it showed an error:
TypeError: forward() missing 1 required positional argument: 'inference'
from torch.autograd import Variable

model = MODNet(backbone_pretrained=False)
model = nn.DataParallel(model).cuda()

state_dict = torch.load(pretrained_ckpt)
model.load_state_dict(state_dict)
model.eval()
dummy_input = Variable(torch.randn(1, 3, 512, 512))
torch.onnx.export(model.module, dummy_input, '/content/MODNet/modnet.onnx', export_params = True)

BTW the test results looks amazing !!!

Hi, thanks for your attention!
Please refer to the forward function of  MODNet defined in the file MODNet/src/models/modnet.py. This function takes an argument inference as the input. Set inference = True will disable the outputs of LRBranch and HRBranch, i.e., s_p and d_p in the paper, to save the inference time.
I am not familiar with onnx, but it seems that onnx does not support conditional statements in the forward function. A possible solution may be to rewrite the forward function by deleting the code related to the argument inference.

Thanks, it worked !!!

I got the error like this:
RuntimeError: Only tuples, lists and Variables supported as JIT inputs/outputs. Dictionaries and strings are also accepted but their usage is not recommended. But got unsupported type NoneType
I don't know, what going wrong!

I got the error like this:
RuntimeError: Only tuples, lists and Variables supported as JIT inputs/outputs. Dictionaries and strings are also accepted but their usage is not recommended. But got unsupported type NoneType
I don't know, what going wrong!

Hi, would you mind sharing your work on the onnx model? I'm trying to do the same but to export it to an OpenVino model after.
I'm pretty new to this so i'm finding my way through. It looks like you exported the entire MODnet to onnx. Wouldnt you have to export each of the three models to ONNX? (LR, HR, FR?)

Also, "Set inference = True will disable the outputs of LRBranch and HRBranch"
Do you not need the LR and HR branch when doing inference?

@ZHKKKe First of all, Thank you for such an amazing work. I really appreciate it.
As you suggested above, I was able to generate .onnx file by modifying your code but got this warning.
/usr/local/lib/python3.6/dist-packages/torch/nn/functional.py:3103: UserWarning: The default behavior for interpolate/upsample with float scale_factor changed in 1.6.0 to align with other frameworks/libraries, and now uses scale_factor directly, instead of relying on the computed output size. If you wish to restore the old behavior, please set recompute_scale_factor=True. See the documentation of nn.Upsample for details.    warnings.warn("The default behavior for interpolate/upsample with float scale_factor changed " /usr/local/lib/python3.6/dist-packages/torch/onnx/symbolic_helper.py:267: UserWarning: You are trying to export the model with onnx:Upsample for ONNX opset version 9. This operator might cause results to not match the expected results by PyTorch. ONNX's Upsample/Resize operator did not match Pytorch's Interpolation until opset 11. Attributes to determine how to transform the input were added in onnx:Resize in opset 11 to support Pytorch's behavior (like coordinate_transformation_mode and nearest_mode). We recommend using opset 11 and above for models using this operator.    "" + str(_export_onnx_opset_version) + ". "
I also tried to inference with this model by using this tutorial.
But I couldn't start InferenceSession. It gives an error as below:
RuntimeException: [ONNXRuntimeError] : 6 : RUNTIME_EXCEPTION : Exception during initialization: /onnxruntime_src/onnxruntime/core/providers/cpu/tensor/upsample.h:277 void onnxruntime::UpsampleBase::ScalesValidation(const std::vector<float>&, onnxruntime::UpsampleMode) const scale >= 1 was false. Scale value should be greater than or equal to 1.
I couldn't figure out. Can you help me or suggest anything so that I can do with it.
Following work is mention below in Colab notebook.
Colab
Here  is the link of onnx model.

I've gotten it to work on onnx.
Have you tried passing on the opset parameter to be 11? Worked for me

Okay, Thank you for help. I completely misunderstood the error. It also worked for me. I updated the onnx file here.

@manthan3C273 Hey, could I share the converted onnx model with the community by adding it to this Repo and README?

@anilsathyan7 @manthanTECHNOZER @Tomas1337 @manthan3C273
Hey, all, sorry for late response (due to my vacation). Would you like to share the converted onnx model and the inference code of the onnx model with the community?
If so, you can share the model and the code with me (I will add them into this Repo), or you canb open a pull request (please let me know first under this question).
Thanks in advance.

Okay sure. I'll share it with you soon.

Okay, sure. I'll do it. But I'm getting dependencies of torch for F. interpolate. Because I got to know that your processed image of inference is looking like this.
`import matplotlib.pyplot as plt
im = F.interpolate(im, size=(im_rh, im_rw), mode='area')
im_np = np.asarray(im)
im_np = im_np.reshape((im_rh, im_rw, 3))
plt.imshow(im_np)
`
Output image
Can you help that how can I pre-process input image without F.interpolate. I think, It may be any option in opencv.  But I didn't know that much about opencv.

I just found the solution. I did it in wrong way. Soon I'll share the model and code.


Strided containers

Have you considered making Vector.t strided (c.f. NumPy)?
The major benefits of this approach are:

Memory efficiency. No pointer chasing for whole-matrix operations.

Code reuse between Vectors and Matrices, e.g.
(** Converts a matrix to a row-major vector in O(1) time. *)
let flatten : t -> Vector.t = ...

let add m1 m2 = Vector.add (flatten m1) (flatten m2)

Update: I probably should've added this as a comment to #27.

The short answer is not Vector.t specifically. Vector.t (and Matrices) is a stop gap that is woefully insufficient for what I actually want for a linear algebra and statistical analysis supporting set of data structures.
The long answer is yes and I was working on implementing this in Bau. It wasn't a show stopper but I quickly arrived at the conclusion that one needed ppx rewriters to achieve fast performance on BigArray iteration. My next step was going to be in creating a variant layer that would manage data representation with minimal copying. But that is a very big task that I didn't (and unfortunately still don't) have the bandwith to tackle.
Perhaps this is a good spot as any to write down my thoughts and experiences on the subject. I think there are several issues in this space, some of which interact in various ways:

Data representations layer. I chose float arrays out of convenience, but depending upon the situation (size, convenience) one can make arguments for BigArrays or float lists. I'm still not certain whether the library should remain flexible (operate over different inputs), strict (one type and everything is converted into that type) or intelligent (take as input lots of different types, and copy when/if needed). My inclination is for an "intelligent" (my naming of that approach exposes my bias) approach, but how to balance the features (and speed) found in a vector based language (ex. J) versus one that is expressive of statistical problems (ex. R) is still unknown to me. The other complications in this area are:

Modular Implicits - Would obviate functorizing operations, but unknown time frame.
Flambda - Seems like the way of the future, how should it effect the design?
Oml's target audience - there is some interest in separating the capabilities in the library away from the low level Bigarray, Lacaml stuff. To me this seems pressing and perhaps a good argument for sticking with float array's at the moment.

Data operations. Linear Algebra and Statistical analysis (which are usually just folds over a set of floats. I want these things to have more of an OCaml/EDSL style (transposing a matrix 2x should be a no-op) and they should be agnostic to the actual representation (computing the mean should be an operation that can take an float array, float list ... etc).

All of this shouldn't discourage you from submitting a PR; working code is infinitely more valuable than no code. I just want to share my thinking on the subject.

A bit OT but note that things like flambda are not available in bytecode which is what js_of_ocaml starts from.
Which leads me to something I wanted to ask for a long time, how much of oml can be compiled to the browser with js_of_ocaml ? E.g. bigarrays are available there, but I doubt lacaml stuff can be brought there.

I did not realize that bigarrays are available on js_of_ocaml! But you're also pointing at another subtle issue of bytecode vs native.
I've reserved a bit of time this and next week to see how much of oml I can built without the lacaml, lbfgs; An OCaml only oml. This will precipitate even more build system hacking, but hopefully an elegant solution will materialize.

@dbuenzli If you have a chance take a look at oml-lite. Some of the big stuff (ex. multivariate and logistic regression) is missing. But it is viable, and hopefully the framework for iteration has been laid.

@rleonid Caveat, I have little knowledge on how oml is structured (I never used it, yet). However I do have the impression that by extracting oml-lite the way you did through cppo means 1) You are going to live a miserable build life in the long term 2) Other third-party libraries wanting to build on top of oml will have to choose between oml-lite and oml and the final user of the third-party library may not agree with the choice the latter did.
My approach would be to rather try to reorganize the API so that oml-lite shows up naturally as  a single library with others libraries gradually mixing in the C and fortran dependencies. The whole could then be distributed through a single package, the sub-libraries letting end-user control the amount of C or fortran they want to bring in their code base.

@dbuenzli Thank you for your feedback. I've replied here https://github.com/hammerlab/oml/issues/173, so maybe we can keep these discussions organized.


Actual Results:
Cannot start container <container id>: iptables failed: iptables --wait -t filter -A DOCKER ! -i docker0 -o docker0 -p tcp -d <IP_ADDRESS> --dport 4000 -J ACCEPT: iptables: No chain/
target/match by that name.

Expected Results:
Container starts without a problem.
Additional info:
I'll also mention these containers are being launched via Apache Mesos (0.23.0) using Marathon. Appears similar to #13914.

Hi!
Please read this important information about creating issues.
If you are reporting a new issue, make sure that we do not have any duplicates already open. You can ensure this by searching the issue list for this repository. If there is a duplicate, please close your issue and add a comment to the existing issue instead.
If you suspect your issue is a bug, please edit your issue description to include the BUG REPORT INFORMATION shown below. If you fail to provide this information within 7 days, we cannot debug your issue and will close it. We will, however, reopen it if you later provide the information.
This is an automated, informational response.
Thank you.
For more information about reporting issues, see https://github.com/docker/docker/blob/master/CONTRIBUTING.md#reporting-other-issues

BUG REPORT INFORMATION
Use the commands below to provide key information from your environment:
docker version:
docker info:
uname -a:
Provide additional environment details (AWS, VirtualBox, physical, etc.):
List the steps to reproduce the issue:
1.
2.
3.
Describe the results you received:
Describe the results you expected:
Provide additional info you think is important:
----------END REPORT ---------
#ENEEDMOREINFO

Please note the other open issues with this error: https://github.com/docker/docker/issues?utf8=✓&q=is%3Aissue+is%3Aopen+No+chain%2Ftarget%2Fmatch+by+that+name

@cpuguy83 looks like some of those have the same error but not quite the same, #13914 seems to be similar.

@mindscratch Have you tried turning off firewalld?

@cpuguy83  we're not using firewalld just iptables

@mindscratch in that issue, upgrading to 1.8.3 seems to resolve the problem; are you still able to reproduce this on 1.8.3 (or 1.9.0)?

I'll have to look at our logs, we put in a cron job that attempts to find the issue and resolve it before it becomes a problem, shoo I haven't noticed. The cron job logs when if it has to fix iptables, so I'll check. I am now running 1.9.0.

I have that same problem.
➜  docker  cat docker-compose.yml
poste:
    image: analogic/poste.io
    volumes:
        - "/srv/mail/data:/data"
    ports:
        - 25:25
        - 80:8081
        - 443:8443
        - 110:110
        - 143:143
        - 465:465
        - 587:587
        - 993:993
        - 995:995
➜  docker  docker-compose up poste
Recreating docker_poste_1
WARNING: Service "poste" is using volume "/data" from the previous container. Host mapping "/srv/mail/data" has no effect. Remove the existing containers (with `docker-compose rm poste`) to use the host volume mapping.
ERROR: Cannot start container 187de1f595dc544c503a4bf565d2101c0b0b3805d601ae704d0014750166776e: failed to create endpoint docker_poste_1 on network bridge: iptables failed: iptables -t nat -A DOCKER -p tcp -d 0/0 --dport 995 -j DNAT --to-destination <IP_ADDRESS>:995 ! -i docker0: iptables: No chain/target/match by that name.
 (exit status 1)
➜  docker  docker -v
Docker version 1.9.1, build a34a1d5
➜  docker  docker info
Containers: 2
Images: 73
Server Version: 1.9.1
Storage Driver: aufs
 Root Dir: /var/lib/docker/aufs
 Backing Filesystem: extfs
 Dirs: 77
 Dirperm1 Supported: true
Execution Driver: native-0.2
Logging Driver: json-file
Kernel Version: 3.16.0-0.bpo.4-amd64
Operating System: Debian GNU/Linux 7 (wheezy)
CPUs: 8
Total Memory: 23.59 GiB
Name: Debian-60-squeeze-64-minimal
ID: 7PDG:3ZCD:RL4G:KJAE:PZCO:XTUH:JLRX:IIM4:DHXM:TWHY:UMCK:4GUS
WARNING: No memory limit support
WARNING: No swap limit support
➜  docker  docker version
Client:
 Version:      1.9.1
 API version:  1.21
 Go version:   go1.4.2
 Git commit:   a34a1d5
 Built:        Fri Nov 20 13:06:12 UTC 2015
 OS/Arch:      linux/amd64

Server:
 Version:      1.9.1
 API version:  1.21
 Go version:   go1.4.2
 Git commit:   a34a1d5
 Built:        Fri Nov 20 13:06:12 UTC 2015
 OS/Arch:      linux/amd64

➜  docker  uname -a
Linux Debian-60-squeeze-64-minimal 3.16.0-0.bpo.4-amd64 #1 SMP Debian 3.16.7-ckt11-1+deb8u6~bpo70+1 (2015-11-11) x86_64 GNU/Linux

What information can I send to you?

I also have the same error

Bug Report Info
ubuntu@ip-172-31-36-213:~/relay_docker$ docker-compose up -d
Removing relaydocker_relay_1
Recreating 22ac1bb421_22ac1bb421_22ac1bb421_relaydocker_relay_1
ERROR: Cannot start container dcd5227651790c197835e3f2016f8c747bb748f86e95d6492c75f5e3f83ab47d: failed to create endpoint relaydocker_relay_1 on network bridge: iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 33320 -j DNAT --to-destination <IP_ADDRESS>:30903 ! -i docker0:  (fork/exec /sbin/iptables: cannot allocate memory)

ubuntu@ip-172-31-36-213:~/relay_docker$ docker version
Client:
 Version:      1.9.1
 API version:  1.21
 Go version:   go1.4.2
 Git commit:   a34a1d5
 Built:        Fri Nov 20 13:12:04 UTC 2015
 OS/Arch:      linux/amd64

Server:
 Version:      1.9.1
 API version:  1.21
 Go version:   go1.4.2
 Git commit:   a34a1d5
 Built:        Fri Nov 20 13:12:04 UTC 2015
 OS/Arch:      linux/amd64
ubuntu@ip-172-31-36-213:~/relay_docker$ docker info
Containers: 69
Images: 563
Server Version: 1.9.1
Storage Driver: aufs
 Root Dir: /var/lib/docker/aufs
 Backing Filesystem: extfs
 Dirs: 701
 Dirperm1 Supported: false
Execution Driver: native-0.2
Logging Driver: json-file
Kernel Version: 3.13.0-74-generic
Operating System: Ubuntu 14.04.2 LTS
CPUs: 1
Total Memory: 992.5 MiB
Name: relay-v1
ID: ZXD2:QKYD:UCX3:2KNK:5J7V:OWHH:CUCS:3V2N:LJWT:YV3N:4BLS:ZBYC
Username: vincentsiu
Registry: https://index.docker.io/v1/
WARNING: No swap limit support
Labels:
 provider=amazonec2
ubuntu@ip-172-31-36-213:~/relay_docker$ uname -a
Linux ip-172-31-36-213 3.13.0-48-generic #80-Ubuntu SMP Thu Mar 12 11:16:15 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
ubuntu@ip-172-31-36-213:~/relay_docker$

Dockerfile
FROM ubuntu:14.04

RUN apt-get update && apt-get install -y openssh-server
#RUN apt-get -y install sudo

RUN mkdir -p /var/run/sshd

# configure sshd_config
RUN sed -i "s/PermitRootLogin.*/PermitRootLogin without-password/g" /etc/ssh/sshd_config
RUN sed -i "s/Port .*/Port 2200/g" /etc/ssh/sshd_config
RUN sed -i "s/LoginGraceTime.*/LoginGraceTime 30/g" /etc/ssh/sshd_config
RUN echo "GatewayPorts yes" >> /etc/ssh/sshd_config

# SSH login fix. Otherwise user is kicked off after login
RUN sed 's@session\s*required\s*pam_loginuid.so@session optional pam_loginuid.so@g' -i /etc/pam.d/sshd

ENV NOTVISIBLE "in users profile"
RUN echo "export VISIBLE=now" >> /etc/profile

# ssh port exposed for the container
EXPOSE 2200

# listening to these ports for port forwarding
EXPOSE 8079-8080
EXPOSE 9875-9876
EXPOSE 30000-31000
CMD ["/usr/sbin/sshd", "-D"]

Docker-compose.yml
relay:
restart: always
build: ./relay
ports:
- "2200:22"
- "8001-9876:8001-9876"
- "30000-31000:30000-31000"
command: /usr/sbin/sshd -D

if I try to expose port 30000-31000 in docker-compose.yml, then running 'Docker-compose up -d' will give me an "iptables failed" error.  If I reduce the number of exposed ports to less than 20, then the container will start.

I have read that I can try restarting the docker daemon with --iptables=false.  How can I do that with docker-compose?

@vincentsiu your issue sounds more related to https://github.com/docker/docker/issues/11185

FWIW I had this exact error and I worked around it by disabling the fail2ban service. I kinda want that service available, so it would be nice if docker/fail2ban played nicely with each other.

I have a similar problem using docker 1.9.1 and centos7 (1511) on a ESXi VM
docker version
    Client:
 Version:      1.9.1
 API version:  1.21
 Go version:   go1.4.2
 Git commit:   a34a1d5
 Built:        Fri Nov 20 13:25:01 UTC 2015
 OS/Arch:      linux/amd64

Server:
 Version:      1.9.1
 API version:  1.21
 Go version:   go1.4.2
 Git commit:   a34a1d5
 Built:        Fri Nov 20 13:25:01 UTC 2015
OS/Arch:      linux/amd64

docker info

Containers: 0
Images: 11
Server Version: 1.9.1
Storage Driver: btrfs
 Build Version: Btrfs v3.16.2
 Library Version: 101
Execution Driver: native-0.2
Logging Driver: json-file
Kernel Version: 3.10.0-327.4.4.el7.x86_64
Operating System: CentOS Linux 7 (Core)
CPUs: 1
Total Memory: 1.797 GiB
Name: swhost-1.rz.tu-bs.de
ID: YNJD:42IN:VKFR:OBQV:4OF3:EIZV:D7ML:MXTO:FJLL:IGP5:JVQG:5POK
WARNING: bridge-nf-call-iptables is disabled
WARNING: bridge-nf-call-ip6tables is disabled

If i start the registry v2 container with:
docker run --rm -ti  -v /mnt/registry/content:/var/lib/registry -p 5000:5000 -v /mnt/registry/config/config.yml:/etc/docker/registry/conf.yml -v /etc/pki/tls/docker/:/mnt --name registry registry:2

the port is closed and i am not able to connect
Host is up (0.00025s latency).
Not shown: 998 filtered ports
PORT     STATE  SERVICE
22/tcp   open   ssh
5000/tcp closed upnp

unable to ping registry endpoint https://swhost-1:5000/v0/
v2 ping attempt failed with error: Get https://swhost-1:5000/v2/: dial tcp <IP_ADDRESS>:5000: connection refused
 v1 ping attempt failed with error: Get https://swhost-1:5000/v1/_ping: dial tcp <IP_ADDRESS>:5000: connection refused

according to firewall-cmd, the port is open
firewall-cmd --zone=public --list-all
public (default, active)
  interfaces: eno16780032
  sources:
  services: dhcpv6-client ssh
  ports: 5000/tcp
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

iptables -L -v -n
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
   10   536 DOCKER     all  --  *      docker0  <IP_ADDRESS>/0            <IP_ADDRESS>/0
    0     0 ACCEPT     all  --  *      docker0  <IP_ADDRESS>/0            <IP_ADDRESS>/0            ctstate RELATED,ESTABLISHED
   10   400 ACCEPT     all  --  docker0 !docker0  <IP_ADDRESS>/0            <IP_ADDRESS>/0
    0     0 ACCEPT     all  --  docker0 docker0  <IP_ADDRESS>/0            <IP_ADDRESS>/0
    0     0 ACCEPT     all  --  *      *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  lo     *       <IP_ADDRESS>/0            <IP_ADDRESS>/0
    0     0 FORWARD_direct  all  --  *      *       <IP_ADDRESS>/0            <IP_ADDRESS>/0
    0     0 FORWARD_IN_ZONES_SOURCE  all  --  *      *       <IP_ADDRESS>/0            <IP_ADDRESS>/0
    0     0 FORWARD_IN_ZONES  all  --  *      *       <IP_ADDRESS>/0            <IP_ADDRESS>/0
    0     0 FORWARD_OUT_ZONES_SOURCE  all  --  *      *       <IP_ADDRESS>/0            <IP_ADDRESS>/0
    0     0 FORWARD_OUT_ZONES  all  --  *      *       <IP_ADDRESS>/0            <IP_ADDRESS>/0
    0     0 ACCEPT     icmp --  *      *       <IP_ADDRESS>/0            <IP_ADDRESS>/0
    0     0 REJECT     all  --  *      *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            reject-with icmp-host-prohibited

...

Chain DOCKER (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  !docker0 docker0  <IP_ADDRESS>/0            <IP_ADDRESS>           tcp dpt:5000

if i stop firewalld
systemctl stop firewalld

 docker run --rm -ti  -v /mnt/registry/content:/var/lib/registry -p 5000:5000 -v /mnt/registry/config/config.yml:/etc/docker/registry/config.yml -v /etc/pki/tls/docker/:/mnt --name registry registry:2

Error response from daemon: Cannot start container b6795863c0469c55e89244e12b764ce686948bfdea57542243beabbf81da4441: failed to create endpoint registry on network bridge: iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 5000 -j DNAT --to-destination <IP_ADDRESS>:5000 ! -i docker0: iptables: No chain/target/match by that name.
 (exit status 1)

We also notice this behaviour.
docker version:
Client:
 Version:      1.9.0
 API version:  1.21
 Go version:   go1.4.2
 Git commit:   76d6bc9
 Built:        Tue Nov  3 17:37:20 UTC 2015
 OS/Arch:      linux/amd64

Server:
 Version:      1.9.0
 API version:  1.21
 Go version:   go1.4.2
 Git commit:   76d6bc9
 Built:        Tue Nov  3 17:37:20 UTC 2015
 OS/Arch:      linux/amd64

docker info:
Containers: 12
Images: 592
Server Version: 1.9.0
Storage Driver: devicemapper
 Pool Name: docker-253:0-2354982-pool
 Pool Blocksize: 65.54 kB
 Base Device Size: 107.4 GB
 Backing Filesystem: extfs
 Data file: /dev/loop0
 Metadata file: /dev/loop1
 Data Space Used: 15.72 GB
 Data Space Total: 107.4 GB
 Data Space Available: 38.99 GB
 Metadata Space Used: 35.24 MB
 Metadata Space Total: 2.147 GB
 Metadata Space Available: 2.112 GB
 Udev Sync Supported: true
 Deferred Removal Enabled: false
 Deferred Deletion Enabled: false
 Deferred Deleted Device Count: 0
 Data loop file: /var/lib/docker/devicemapper/devicemapper/data
 Metadata loop file: /var/lib/docker/devicemapper/devicemapper/metadata
 Library Version: 1.02.74 (2012-03-06)
Execution Driver: native-0.2
Logging Driver: json-file
Kernel Version: 3.2.69-xnt-nogr-1.5.3
Operating System: Debian GNU/Linux 7 (wheezy)
CPUs: 16
Total Memory: 15.88 GiB
Name: dev03.servicehouse.nl
ID: F4IG:2KNZ:TABI:SHGC:RWIN:3AYQ:5EX2:XI7N:DOHP:2VXQ:ASDK:RFF6
WARNING: No memory limit support
WARNING: No swap limit support

uname -a:
Linux dev03 3.2.69-xnt-nogr-1.5.3 #1 SMP Thu May 14 21:03:15 CEST 2015 x86_64 GNU/Linux

Provide additional environment details (AWS, VirtualBox, physical, etc.):
This environment is a XenServer virtual host.
iptables v1.4.14
List the steps to reproduce the issue:

Start container with exposed ports mapped to host ports
Stop container
Repeat

Describe the results you received:
root@dev03:~# docker restart foo
Error response from daemon: Cannot restart container foo: failed to create endpoint foo on network bridge: iptables failed: iptables -t filter -A DOCKER ! -i docker0 -o docker0 -p tcp -d <IP_ADDRESS> --dport 1234 -j ACCEPT: iptables: No chain/target/match by that name.
 (exit status 1)
Error: failed to restart containers: [foo]

Describe the results you expected:
A successful docker restart.

This is happening to me too.

Error response from daemon: Cannot restart container HAProxy: failed to create endpoint HAProxy on network bridge: iptables failed: iptables --wait -t filter -A DOCKER ! -i docker0 -o docker0 -p tcp -d <IP_ADDRESS> --dport 8888 -j ACCEPT: iptables: No chain/target/match by that name.
(exit status 1)

And if I run:

# iptables -N DOCKER
iptables: Chain already exists.

FYI: Just to have in mind, I'm running docker-compose with the root user, and I didn't saw anyone in this post running commands with sudo or su.
Although restarting the docker service restores the heath of the system for a while at least, it is a horrible workaround....
Any other alternatives or ETA for when this will be fixed?
Best,

I have met a similar problem and it was solved by running this command:
# iptables -t filter -N DOCKER
Hope it helps!

It happened to us as well, but in our case iptables -t filter -L -v -n showed that DOCKER chain exists, only when checking the nat table using iptables -t nat -L -v -n we found out that somehow DOCKER chain was disappear...

Chain PREROUTING (policy ACCEPT 6402K packets, 388M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 981K packets, 62M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 1001K packets, 63M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 514K packets, 31M bytes)
 pkts bytes target     prot opt in     out     source               destination
  83M 5047M FLANNEL    all  --  *      *       <IP_ADDRESS>/16       <IP_ADDRESS>/0
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:8080
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:8081
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:8080
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:8080
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:8081
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:8080
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:53
    0     0 MASQUERADE  udp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       udp dpt:53
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:3000
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:1936
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:443
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:88
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:80
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:53
    0     0 MASQUERADE  udp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         udp dpt:53
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:1936
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:443
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:88
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:80
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:8080
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:3000
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:8081
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:8080
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:8081
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:8080
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>        <IP_ADDRESS>        tcp dpt:8080

Chain FLANNEL (1 references)
 pkts bytes target     prot opt in     out     source               destination
5481K  332M ACCEPT     all  --  *      *       <IP_ADDRESS>/0            <IP_ADDRESS>/16
 426K   27M MASQUERADE  all  --  *      *       <IP_ADDRESS>/0           !<IP_ADDRESS>/4

After restarting docker daemon everything worked fine and we could see DOCKER chain came back to nat table:
Chain PREROUTING (policy ACCEPT 5765 packets, 347K bytes)
 pkts bytes target     prot opt in     out     source               destination
 1592 96542 DOCKER     all  --  *      *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT 1236 packets, 75057 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 3135 packets, 203K bytes)
 pkts bytes target     prot opt in     out     source               destination
    1    77 DOCKER     all  --  *      *       <IP_ADDRESS>/0           !<IP_ADDRESS>/8          ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT 2423 packets, 159K bytes)
 pkts bytes target     prot opt in     out     source               destination
  83M 5047M FLANNEL    all  --  *      *       <IP_ADDRESS>/16       <IP_ADDRESS>/0
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:8080
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:8081
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:8080
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:8080
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:8081
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:8080
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:53
    0     0 MASQUERADE  udp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       udp dpt:53
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:3000
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:1936
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:443
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:88
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>       <IP_ADDRESS>       tcp dpt:80
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:53
    0     0 MASQUERADE  udp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         udp dpt:53
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:1936
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:443
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:88
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:80
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:8080
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:3000
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:8081
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:8080
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:8081
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:8080
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>        <IP_ADDRESS>        tcp dpt:8080
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:53
    0     0 MASQUERADE  udp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         udp dpt:53
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:3000
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:5601
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:8201
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:8200
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:8080
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>         <IP_ADDRESS>         tcp dpt:8080
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>        <IP_ADDRESS>        tcp dpt:8081
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>        <IP_ADDRESS>        tcp dpt:8080
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>        <IP_ADDRESS>        tcp dpt:8081
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>        <IP_ADDRESS>        tcp dpt:8080
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>        <IP_ADDRESS>        tcp dpt:1936
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>        <IP_ADDRESS>        tcp dpt:443
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>        <IP_ADDRESS>        tcp dpt:88
    0     0 MASQUERADE  tcp  --  *      *       <IP_ADDRESS>        <IP_ADDRESS>        tcp dpt:80

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  !docker0 *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            tcp dpt:53 to:<IP_ADDRESS>:53
    0     0 DNAT       udp  --  !docker0 *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            udp dpt:53 to:<IP_ADDRESS>:53
    0     0 DNAT       tcp  --  !docker0 *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            tcp dpt:3210 to:<IP_ADDRESS>:3000
    0     0 DNAT       tcp  --  !docker0 *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            tcp dpt:5601 to:<IP_ADDRESS>:5601
    0     0 DNAT       tcp  --  !docker0 *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            tcp dpt:8201 to:<IP_ADDRESS>:8201
    0     0 DNAT       tcp  --  !docker0 *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            tcp dpt:8200 to:<IP_ADDRESS>:8200
    0     0 DNAT       tcp  --  !docker0 *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            tcp dpt:8050 to:<IP_ADDRESS>:8080
    0     0 DNAT       tcp  --  !docker0 *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            tcp dpt:9002 to:<IP_ADDRESS>:8080
    0     0 DNAT       tcp  --  !docker0 *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            tcp dpt:8041 to:<IP_ADDRESS>:8081
    0     0 DNAT       tcp  --  !docker0 *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            tcp dpt:8040 to:<IP_ADDRESS>:8080
    0     0 DNAT       tcp  --  !docker0 *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            tcp dpt:8081 to:<IP_ADDRESS>:8081
    0     0 DNAT       tcp  --  !docker0 *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            tcp dpt:8080 to:<IP_ADDRESS>:8080
   27  1620 DNAT       tcp  --  !docker0 *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            tcp dpt:1936 to:<IP_ADDRESS>:1936
    0     0 DNAT       tcp  --  !docker0 *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            tcp dpt:443 to:<IP_ADDRESS>:443
  139  8340 DNAT       tcp  --  !docker0 *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            tcp dpt:88 to:<IP_ADDRESS>:88
   24  1440 DNAT       tcp  --  !docker0 *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            tcp dpt:80 to:<IP_ADDRESS>:80

Chain FLANNEL (1 references)
 pkts bytes target     prot opt in     out     source               destination
5489K  332M ACCEPT     all  --  *      *       <IP_ADDRESS>/0            <IP_ADDRESS>/16
 427K   27M MASQUERADE  all  --  *      *       <IP_ADDRESS>/0           !<IP_ADDRESS>/4

If someone has a clue for why the chain disappear I'll be more than happy to hear about it.

Exactly the same issue here as @shayts7 is describing. Workaround for now is to restart the daemon:
service docker restart

@fredrikaverpil Great! It worked!

Hello everyone,
I'm using coreos and have this problem too but only on my master.
Running iptables -t nat -N DOCKER solves the problem, pods are automatically created and everything is fine. I'm looking to know why this chain is removed on my master and not on my workers.

Was having this issue. For us it turned out docker was starting before our firewall persistence (iptables-persistent) and its rules were getting overwritten. I resolved by removing the package as we were using it for only 1 rule.
There are ways to keep it working side by side by either ensuring docker starts after iptables-persistent(https://groups.google.com/forum/#!topic/docker-dev/4SfOwCOmw-E) or by adding whatever rules the docker service adds into the persistent iptables configuration(didn't test this).
May be of help @Seraf, @shayts7

@vlad-vintila-hs Thanks for the tip

Same issue here Ubuntu 14.04 with docker 1.11.1 and docker-compose 1.7.1 no workaround solved the problem.

This seems to only happen on CentOS 7 for me.
This is what I did
stop firewalld
sudo systemctl stop firewalld
sudo systemctl disable firewalld

Restart your machine
sudo reboot

As long as you've put --restart=always to your docker instance. When your machine is reboot, the docker instance should be running, and the port should be binded. I believe this issue is specificly to CentOS7 family who uses firewalld instead of iptables.

@vlad-vintila-hs  I encountered the same.Thanks for the tip.

follow @fredrikaverpil .Thank you.
I try:
ip link delete docker0

systemctl restart docker

@kanlidy 用你的方法解决了, 多谢.

This worked for me !! on all CentOS7.2 systems
ip link delete docker0
systemctl restart docker

good

This only fixes running containers using:
docker run -d -p ...
but it still doesn't work on docker swarm 1.12 and 1.12.1 using
docker service create --publish ...
It won't open port and complains about failed: iptables: No chain/target/match by that name on series of iptables rules in firewalld logs

Got the same problem as @virtuman, working with docker 1.12.1 on Photon OS with no firewalld active.
 [ ~ ]# iptables -t nat -L -v -n
Chain PREROUTING (policy ACCEPT 445 packets, 26876 bytes)
 pkts bytes target     prot opt in     out     source               destination
88136 5323K DOCKER-INGRESS  all  --  *      *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            ADDRTYPE match dst-type LOCAL
 9768  590K DOCKER     all  --  *      *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT 445 packets, 26876 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 336 packets, 20552 bytes)
 pkts bytes target     prot opt in     out     source               destination
   55  3740 DOCKER-INGRESS  all  --  *      *       <IP_ADDRESS>/0            <IP_ADDRESS>/0            ADDRTYPE match dst-type LOCAL
    5   322 DOCKER     all  --  *      *       <IP_ADDRESS>/0           !<IP_ADDRESS>/8          ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT 336 packets, 20552 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  all  --  *      !docker0  <IP_ADDRESS>/16        <IP_ADDRESS>/0
    3   246 MASQUERADE  all  --  *      !docker_gwbridge  <IP_ADDRESS>/16        <IP_ADDRESS>/0
   25  1380 MASQUERADE  all  --  *      docker_gwbridge  <IP_ADDRESS>/0            <IP_ADDRESS>/0            ADDRTYPE match src-type LOCAL
   23  1619 MASQUERADE  all  --  *      !docker_gwbridge  <IP_ADDRESS>/16        <IP_ADDRESS>/0

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 RETURN     all  --  docker0 *       <IP_ADDRESS>/0            <IP_ADDRESS>/0
    0     0 RETURN     all  --  docker_gwbridge *       <IP_ADDRESS>/0            <IP_ADDRESS>/0

Chain DOCKER-INGRESS (2 references)
 pkts bytes target     prot opt in     out     source               destination
 9759  589K RETURN     all  --  *      *       <IP_ADDRESS>/0            <IP_ADDRESS>/0

On overlay network:
[ ~ ]# docker network inspect mynet
[
    {
        "Name": "mynet",
        "Id": "5glt9tb0yaoqz8l89mp3jdrkc",
        "Scope": "swarm",
        "Driver": "overlay",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": []
        },
        "Internal": false,
        "Containers": null,
        "Options": {
            "com.docker.network.driver.overlay.vxlanid_list": "259"
        },
        "Labels": null
    }
]

 [ ~ ]# docker service inspect mytest
[
    {
        "ID": "0nh2vprk2w0mmkj4cve7v1qsg",
        "Version": {
            "Index": 518
        },
        "CreatedAt": "2016-09-16T10:24:43.236431157Z",
        "UpdatedAt": "2016-09-16T10:24:43.238035043Z",
        "Spec": {
            "Name": "mytest",
            "TaskTemplate": {
                "ContainerSpec": {
                    "Image": "nginx"
                },
                "Resources": {
                    "Limits": {},
                    "Reservations": {}
                },
                "RestartPolicy": {
                    "Condition": "any",
                    "MaxAttempts": 0
                },
                "Placement": {}
            },
            "Mode": {
                "Replicated": {
                    "Replicas": 1
                }
            },
            "UpdateConfig": {
                "Parallelism": 1,
                "FailureAction": "pause"
            },
            "Networks": [
                {
                    "Target": "5glt9tb0yaoqz8l89mp3jdrkc"
                }
            ],
            "EndpointSpec": {
                "Mode": "vip",
                "Ports": [
                    {
                        "Protocol": "tcp",
                        "TargetPort": 80,
                        "PublishedPort": 8080
                    }
                ]
            }
        },
        "Endpoint": {
            "Spec": {
                "Mode": "vip",
                "Ports": [
                    {
                        "Protocol": "tcp",
                        "TargetPort": 80,
                        "PublishedPort": 8080
                    }
                ]
            },
            "Ports": [
                {
                    "Protocol": "tcp",
                    "TargetPort": 80,
                    "PublishedPort": 8080
                }
            ],
            "VirtualIPs": [
                {
                    "NetworkID": "ba71d2djs4vvsdvsrcfltbktr",
                    "Addr": "<IP_ADDRESS>/16"
                },
                {
                    "NetworkID": "5glt9tb0yaoqz8l89mp3jdrkc",
                    "Addr": "<IP_ADDRESS>/24"
                }
            ]
        },
        "UpdateStatus": {
            "StartedAt": "0001-01-01T00:00:00Z",
            "CompletedAt": "0001-01-01T00:00:00Z"
        }
    }
]

Sep 16 12:26:19 primapp03 docker[25944]: time="2016-09-16T12:26:19.387872821+02:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -L DOCKER-INGRESS]"
Sep 16 12:26:19 primapp03 docker[25944]: time="2016-09-16T12:26:19.390079278+02:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -C DOCKER-INGRESS -j RETURN]"
Sep 16 12:26:19 primapp03 docker[25944]: time="2016-09-16T12:26:19.391680179+02:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -C OUTPUT -m addrtype --dst-type LOCAL -j DOCKER-INGRESS]"
Sep 16 12:26:19 primapp03 docker[25944]: time="2016-09-16T12:26:19.394019719+02:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -C PREROUTING -m addrtype --dst-type LOCAL -j DOCKER-INGRESS]"
Sep 16 12:26:19 primapp03 docker[25944]: time="2016-09-16T12:26:19.396305291+02:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -C POSTROUTING -m addrtype --src-type LOCAL -o docker_gwbridge -j MASQUERADE]"
Sep 16 12:26:19 primapp03 docker[25944]: time="2016-09-16T12:26:19.398715424+02:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -L DOCKER-INGRESS]"
Sep 16 12:26:19 primapp03 docker[25944]: time="2016-09-16T12:26:19.401384962+02:00" level=debug msg="/usr/sbin/iptables, [--wait -t nat -I DOCKER-INGRESS -p tcp --dport 8080 -j DNAT --to-destination <IP_ADDRESS>:8080]"
Sep 16 12:26:19 primapp03 docker[25944]: time="2016-09-16T12:26:19.404212138+02:00" level=debug msg="Creating service for vip <IP_ADDRESS> fwMark 259 ingressPorts []*libnetwork.PortConfig{&libnetwork.PortConfig{Name: \"\",\nProtocol: 0,\nTargetPort: 0x50,\nPublishedPort: 0x1f90,\n}}"
Sep 16 12:26:19 primapp03 docker[25944]: time="2016-09-16T12:26:19+02:00" level=info msg="Firewalld running: false"
Sep 16 12:26:19 primapp03 docker[25944]: time="2016-09-16T12:26:19+02:00" level=error msg="setting up rule failed, [-t nat -A POSTROUTING -m ipvs --ipvs -d <IP_ADDRESS>/16 -j SNAT --to-source <IP_ADDRESS>]:  (iptables failed: iptables --wait -t nat -A POSTROUTING -m ipvs --ipvs -d <IP_ADDRESS>/16 -j SNAT --to-source <IP_ADDRESS>: iptables: No chain/target/match by that name.\n (exit status 1))"
Sep 16 12:26:19 primapp03 docker[25944]: time="2016-09-16T12:26:19.435268378+02:00" level=error msg="Failed to add firewall mark rule in sbox /var/run/docker/netns/be3e41082632: reexec failed: exit status 5"
Sep 16 12:26:19 primapp03 docker[25944]: time="2016-09-16T12:26:19.435677746+02:00" level=error msg="Failed to create real server <IP_ADDRESS> for vip <IP_ADDRESS> fwmark 259 in sb ingress-sbox: no such process"

I'm having the same issue as @virtuman and @ummecasino. When I create a service with docker service create --publish ..., firewalld shows:
ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t nat -C POSTROUTING -m ipvs --ipvs -d <IP_ADDRESS>/16 -j SNAT --to-source <IP_ADDRESS>' failed: iptables: No chain/target/match by that name.
And, I can't connect to the service outside of localhost. How do I get this to work, besides shutting off firewalld?

See https://github.com/docker/docker/issues/16816#issuecomment-197397543
For me, I do the same thing except instead of nat, I specify filter.

restarting docker worked for me.  The issue occurred when I turned off firewalld. restarting docker will update the iptable rules

I had a comparable issue with iptables. I'm running a container pair with Nginx and Django. I noticed my website was extremely slow to respond (20 seconds), so I wanted to restart the containers with docker-compose:
[root@cvast cvast]# docker-compose down
[...]
[root@cvast cvast]# docker-compose up -d
Creating network "cvast_default" with the default driver
ERROR: Failed to Setup IP tables: Unable to enable SKIP DNAT rule:  (iptables failed: iptables --wait -t nat -I DOCKER -i br-bff977f9efd3 -j RETURN: iptables: No chain/target/match by that name.
 (exit status 1))

I only tried this and it fixed it right away:
systemctl restart docker.service

Some debug info:
[vincent@cvast ~]$ cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.2 (Maipo)

[vincent@cvast ~]$ uname -a
Linux cvast 3.10.0-327.36.1.el7.x86_64 #1 SMP Wed Aug 17 03:02:37 EDT 2016 x86_64 x86_64 x86_64 GNU/Linux

[vincent@cvast ~]$ docker version
Client:
 Version:      1.12.1
 API version:  1.24
 Go version:   go1.6.3
 Git commit:   23cf638
 Built:
 OS/Arch:      linux/amd64

Server:
 Version:      1.12.1
 API version:  1.24
 Go version:   go1.6.3
 Git commit:   23cf638
 Built:
 OS/Arch:      linux/amd64

This is no familiar terrain for me, so I hope anyone can explain to me what happened and/or if it was something I did. My firewall is managed by the university I work for; could it be something they changed?  Was the slowness of my website related? It is fast as normal now after I restarted docker.service.
Thank you very much!

@veuncent docker creates the docker chain in IPTables rules on startup; if some other system (such as firewalld) is removing those rules after docker is started, this error can occur. Make sure the docker daemon i started after firewalld.

Also ping @aboch, as I think there were some changes recently for how this error is handled.

Tested out this fix today : https://github.com/docker/libnetwork/pull/1658
We were hitting "unable to remove jump to DOCKER-ISOLATION rule in FORWARD chain: (iptables failed: iptables --wait -D FORWARD -j DOCKER-ISOLATION: iptables: No chain/target/match by that name." intermittently on Centos7.3 when running "docker-compose up" multiple times. #1658 fixed the issue for us.

fixed ?

Hi
I used docker-compose command to start elasticSerach, logstash and Kibana and run normally for several hours, then ELK can not work properly. So I tried to restart the docker elasticSearch or logstatsh or Kibana but met similar problem.
Steps to reproduce the issue:

Use docker-compose to start ELK docker
Observed data loading stopped in Kibana dashboard
Try to restart docker elasticSearch or logstash or Kibana, then met the results mentioned below.
If run sudo service docker restart command, then can start ELK again

Describe the results you received:
Error response from daemon: Cannot restart container : driver failed programming external connectivity on endpoint dockerelk_elasticsearch_1 :  (iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 9300 -j DNAT --to-destination <IP_ADDRESS>:9300 ! -i: iptables: No chain/target/match by that name.
Describe the results you expected:
Docker can run normally without this problem and no need restart.
Additional information you deem important (e.g. issue happens only occasionally):
The problem happened after several hours normal running.
Output of docker version:
Client:
 Version:      17.03.1-ce
 API version:  1.27
 Go version:   go1.7.5
 Git commit:   c6d412e
 Built:        Mon Mar 27 17:07:28 2017
 OS/Arch:      linux/amd64

Server:
 Version:      17.03.1-ce
 API version:  1.27 (minimum version 1.12)
 Go version:   go1.7.5
 Git commit:   c6d412e
 Built:        Mon Mar 27 17:07:28 2017
 OS/Arch:      linux/amd64
 Experimental: false

Output of docker info:
Containers: 8
 Running: 0
 Paused: 0
 Stopped: 8
Images: 5
Server Version: 17.03.1-ce
Storage Driver: aufs
 Root Dir: /var/lib/docker/aufs
 Backing Filesystem: extfs
 Dirs: 77
 Dirperm1 Supported: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host macvlan null overlay
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
init version: 949e6fa
Kernel Version: 3.16.0-4-amd64
Operating System: Debian GNU/Linux 8 (jessie)
OSType: linux
Architecture: x86_64
CPUs: 2
Total Memory: 3.866 GiB

Additional environment details (AWS, VirtualBox, physical, etc.):
uname -a
Linux scav-dev.fordme.com 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03) x86_64 GNU/Linux

Problem also happens on openSUSE Tumbleweed.
But, `ip link delete docker0
systemctl restart docker`
Solves it too.

https://github.com/docker/libnetwork/pull/1658 was merged into docker 17.03.2 and is included in docker 17.04.0 and up, and should resolve issues in this area. Unfortunately, this issue has become a collection of issues that may, or may not be related, so the fix may not resolve all occurrences of this message (e.g., firewalld ripping out IPTables rules while docker is running can still be an issue)

firewalled remove DOCKER's rule
do somethin that systemctl restart docker to solves

Hello everyone!
I have faced this issue, and found out that after running my firewall script it removes the DOCKER chain, reason why it gets this error... so, when restarting docker service, it will fix this problem, because docker recreate the chains used by its service.
To fix:
service docker stop
service docker start

But, it would be nice if when running any create container command docker check if there is its chain or recreate that.
Would it be possible to update it?
Sorry not being possible to contribute with a pull request.

Hi All,
I faced the same problem, it fixed for me.
Enter below command,  it will clear all chains.
iptables -t filter -F

iptables -t filter -X

Then restart Docker Service
 systemctl restart docker
I hope it will work.

@Rajesh-jai
I would suggest you do not flush neither delete your firewal rules... unless if you do know what you are doing.
Restarting your docker will recreate rules that will allow your access to your containers, without the need of flushing and deleting all iptables rules.
Carefull with that. You might get you server too open with that.
Cheers!

In centos7.1 and docker 1.10.3-46, I restart docker service then solve the prolem.

I can consistently replicate the problem using the following steps:

Add/Change iptables rule
Restart iptables
Restart container mapped to local ports

I get the following error:
ERROR: for webfront  Cannot restart container 4cf3aa80c0ca093f311b064c4318477e0d64654e0e3b2921f2e130b3004fe125: driver failed programming external connectivity on endpoint webfront (db42a8b5113b0ed0386a7232004144ba3ee0464eeeee205e04eeac9c19ddad04): iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d <IP_ADDRESS> --dport 8093 -j DNAT --to-destination <IP_ADDRESS>:80 ! -i br-1b5d4184a095: iptables: No chain/target/match by that name.
 (exit status 1)

One fix is to disable the firewall integration (?) described here: https://github.com/moby/moby/issues/1871#issuecomment-238761325

@vagnerfonseca  CentOS 6 and kernel 2.6.x hasn't been supported for a long time (last version of docker supporting that was Docker 1.7, which was released three years ago, and has reached end of life a long time ago.
If you want to run Docker, make sure to update to a currently supported release of CentOS 7

In my case (Manjaro Linux) this was cause by iptables simply not running at all. I had to add docker daemon option --iptables=false to disable any interaction with it.

I encountered the same issue recently. I solved it by flushing iptables by
iptable -F

I ran into this when my default firewalld zone was somehow changed from 'home' to 'public'.  I resolved it by changing the default back to home, restarting firewalld, then flushing iptables:
firewall-cmd --set-default-zone=home firewall-cmd --reload systemctl restart firewalld iptables -F

Adding my +1.
Running Arch Linux.
 Running: 0
 Paused: 0
 Stopped: 1
Images: 3
Server Version: 18.05.0-ce
Storage Driver: overlay2
 Backing Filesystem: extfs
 Supports d_type: true
 Native Overlay Diff: false
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 773c489c9c1b21a6d78b5c538cd395416ec50f88
runc version: 4fc53a81fb7c994640722ac585fa9ca548971871
init version: 949e6fa
Security Options:
 seccomp
  Profile: default
Kernel Version: 4.14.52-1-lts
Operating System: Arch Linux
OSType: linux
Architecture: x86_64
CPUs: 6
Total Memory: 11.72GiB
Name: mephisto
ID: BRRC:XMKV:WWAM:77LE:35HV:JGCX:P3MS:QZQX:3GOC:REIC:53Y4:ZEHL
Docker Root Dir: /home/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
 <IP_ADDRESS>/8
Live Restore Enabled: false```

I have `iptables` installed, but not `firewalld`.

```Jul 31 13:24:56 mephisto docker[18190]: /usr/bin/docker: Error response from daemon: driver failed programming external connectivity on endpoint proxy.service (c78e90b3b41c831de60a048d0dcfd73de325e91b2f3c048b27c848ced4972b43):  (iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 8080 -j DNAT --to-destination <IP_ADDRESS>:8080 ! -i docker0: iptables: No chain/target/match by that name.```

Only work around so far is to use `--net=host` which is not necessarily desirable.

In my case (Manjaro Linux) this was cause by iptables simply not running at all. I had to add docker daemon option --iptables=false to disable any interaction with it.

iptables was causing me grief (on Manjaro, so ultimately I stopped it and following your example set iptables: false. This worked for me.

I have solved the issue by typing
service iptables restart and service docker restart . Hope it helps.

Here too!

sudo systemctl restart docker.socket

It might help others:
if you are connected to internet via a VPN, try disabling it.
Some providers/apps will modify iptables in order to not let traffic pass through except in the created tunnel.

I don't see any recent activity on this issue.  I will close it as stale.


fix: prevent matching native statements in serializeFunction

As reported in https://github.com/nuxt/nuxt.js/commit/25d26ba42f97fa738592df4f85e692a557ffa1bf#r31725441, serializeFunction() introduce a bug where it's matching native JS statements.

Merging as a hotfix. Improvement can be addressed later.


Description limit

https://trello.com/c/ZUH5tdEy/221-increase-description-size-limit-some-ka-content-has-longer-descriptions


Don't have a search bar

Odd timing to have come back to repentance and see you update the tracker live lmao but I seem to no longer have the ability to filter through my past runs? I seem to remember having a search bar before at least where I could search by character, date etc, was wondering if this isn't a supported feature anymore.

I've never used github before so I'm not sure if I wrote this in the correct place. The background of the application seems to have changed also (I think*) used to be slightly darker iirc, would love some kind of dark mode

@Shaniquaniminiquani That's strange ! Can you give me your last backup ?
Close the app and go to : C:\Users\YOURNAME\AppData\Roaming\repentanceruntracker\backups -> give me the last created zip
I was thinking about a dark mode hehe, i have to think about that yes

backup_datas_07-23-22-042317AM.zip
Here it is

@Shaniquaniminiquani I found the issue, looks like you have a corrupted run :

I fixed the filters but i'm checking if i can automatically remove corrupted runs

Ah yeah, I seem to remember that happening when I tried launching the tracker with mods on way back. It would just instantly crash and give me corrupted runs. Most went away but I remember not being able to get rid of one. Thankfully I don't usually play with mods, my streak had died the run before that so I was peer pressured into playing with mods 💀🙏

It should be fixed in last release let me know !
https://github.com/aymericingargiola/repentance-run-tracker/releases/tag/v0.7.4

Does indeed seem to be fixed. Ty 🙏


Cannot find module: @babel/runtime

I'm trying to get started and am getting an error when I try to build the current version.
[19:07:59] 'build:extension:js:deps:ui' errored after 8.08 s
[19:07:59] Error: Cannot find module '@babel/runtime/core-js/map' from '/home/jeremy/metamask-plugin-beta/node_modules/@material-ui/core/styles'
    at /home/jeremy/metamask-plugin-beta/node_modules/browser-resolve/node_modules/resolve/lib/async.js:46:17
    at process (/home/jeremy/metamask-plugin-beta/node_modules/browser-resolve/node_modules/resolve/lib/async.js:173:43)
    at ondir (/home/jeremy/metamask-plugin-beta/node_modules/browser-resolve/node_modules/resolve/lib/async.js:188:17)
    at load (/home/jeremy/metamask-plugin-beta/node_modules/browser-resolve/node_modules/resolve/lib/async.js:69:43)
    at onex (/home/jeremy/metamask-plugin-beta/node_modules/browser-resolve/node_modules/resolve/lib/async.js:92:31)
    at /home/jeremy/metamask-plugin-beta/node_modules/browser-resolve/node_modules/resolve/lib/async.js:22:47
    at FSReqWrap.oncomplete (fs.js:153:21)

I've tried installing babel/runtime, and reinstalling gulp

Sorry for the slow reply, took a week off right after Devcon. We're back now!
Did you npm install, or did you follow the readme, which recommends using node v10 and yarn to install the dependencies?

To add to Dan's question, what script from package.json are you running when you encounter this error?

Updating node and using yarn and yarn dist instead of npm i and npm run dist` solved the problem. Thank you.

Would it make sense to prevent people to use npm in this case?
Something like
"engines": {
"npm": "please-use-yarn",
"node": "^10.16.0",
"yarn": "^1.16.0"
}
And
engine-strict = true in .npmrc

relevant https://github.com/MetaMask/metamask-snaps-beta/issues/155


Add ski.d.ts

ski/ski.d.ts
check list

[ ] is collect naming convention?

https://www.npmjs.com/package/ski
http://bower.io/search/?q=ski
others?

[X] has a test file? (ski/ski-tests.ts or others)
[ ] pass the Travis-CI test?

@AyaMorisawa thanks mate!


Android - Subscription Always returns as Owned after initial purchase

I have integrated this module in my react native app. The purchase of subscription works fine.
The call to await Glassfy.restorePurchases(); returns the below response:
{"all": [{"accountableSkus": [Array], "entitlement": -5, "expireDate":<PHONE_NUMBER>, "isValid": false, "permissionId": "pmp_permissions"}, {"accountableSkus": [Array], "entitlement": -5, "expireDate":<PHONE_NUMBER>, "isValid": false, "permissionId": "permissions"}], "subscriberId": "7de8695b6ed64753abd75ab6c956d61c"}

As seen, the permission is not valid. When I try to buy the subscription again, it gives the below error:
{"nativeStackAndroid":[],"userInfo":null,"message":"GlassfyError(code=ProductAlreadyOwned, description=Product already owned, debug=Failure to purchase since item is already owned (ITEM_ALREADY_OWNED))","code":"GlassfyError(code=ProductAlreadyOwned, description=Product already owned, debug=Failure to purchase since item is already owned (ITEM_ALREADY_OWNED))"}
I'm using 1.5.3
Please advise.

Could you please contact as using the intercom bubble on our website? We would like to access the exact account to check it out and we need some of yours personal details.


Migrate deprecated Github Services to new integrations

For example, we still use Travis through the deprecated Github Services integration. This may also be the case with other stuff we use.
The Travis migration guide is here: https://docs.travis-ci.com/user/legacy-services-to-github-apps-migration-guide/

Travis migration has been performed. I've requested the project to be migrated directly instead of waiting for the automated migration. This means we'll lose the build history but that's not a problem for us.


Has anyone successfully run Whisper in Swift?

Looking to see if anyone has an example on how to run whisper with swift!

Check out https://github.com/argmaxinc/WhisperKit -- that is in swift and they have a branch & PR for using MLX


Fails to build without openssl

End of ./configure's output:
ZNC 1.7.x configured

prefix:       /usr/local
debug:        no
ipv6:         yes
openssl:      no (libssl not found)
dns:          threads
perl:         no
python:       no
swig:         not needed
cyrus:        no
tcl:          no
charset:      no (icu-uc not found via pkg-config)
zlib:         yes
run from src: no

Now you can run "make" to compile ZNC

Afterwards, make gives me:
Building core object Csocket...
src/Csocket.cpp:980:55: error: no 'bool Csock::SNIConfigureClient(CString&)' member function declared in class 'Csock'
 bool Csock::SNIConfigureClient( CS_STRING & sHostname )
                                                       ^
src/Csocket.cpp:1523:8: error: 'SSL_CTX' does not name a type
 static SSL_CTX * GetSSLCTX( int iMethod )
        ^~~~~~~
Makefile:132: recipe for target 'src/Csocket.o' failed

---
Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/40877879-fails-to-build-without-openssl?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github).

@psychon did your commit fix this?

The one to Csocket? Yes, I guess so, but ZNC's Csocket version was not updated since. Feel free to try it out anyway. ;-)


"Submit and repeat" button does not submit added results

I expected the "Submit and repeat" button would submit added results, but the results that I thought were being submitted were not shown in the results list of my submission.
I fixed my submission manually by entering each result separately and clicking "Submit".

This was the same issue as Karla's: It's been fixed, Misty.


Rx max size (#cells) does not match the documentation (ha)

Corrected so that the inputs match the documentation.  BOTH should be in hectares.


readme js file

about 2.3 template setup of readme... should be minified file, right? its currently not.
<?= js('assets/plugins/imageset/js/dist/imageset.min.js') ?>

i did add the minified script to my loadjs chain so i can use whatever version your plugin provides – keeping plugin code separated from website code. no webpack merge etc.
you could add a note here that a minified version is available as well.

Replaced with minified file in cb36c2c4718f7ad5bb60893e038c91bff847d1b6.


Height and weight validation

Ensure and validate that height input and weight input on the data collect modal are in a certain format for data consistency.
Example:

Height: 5'9
Weight: (insert number) LBS

Design courtesy of @j33l :

Pretty much done.. but I feel like it would be better to change this into a slider in the future.

Renders differently depending on what unit is chosen. Converts feet/cm into inches and rounds. Kg is converted into lbs and rounded as well.

@qtdinh I agree that a slider is better. We could create a low priority ticket for the future.


liquibase execute-sql return Invalid SQL type: sqlKind = UNINITIALIZED

Search first

[X] I searched and no similar issues were found

Description
calling
"liquibase", "execute-sql",
                "--log-level=INFO",
                "--defaultsFile=props.properties",
                "--default-schema-name=TEST",
                "--delimiter=\\",
                "--sql=\"SELECT ENV FROM BC_HELPER\""

i did experiment with delimiter in various way, as i read it could be the issue (try with ; \ /)
with oracle db
i got the following exception
liquibase.exception.CommandExecutionException: liquibase.exception.DatabaseException: Invalid SQL type: sqlKind = UNINITIALIZED [Failed SQL: (17439) "SELECT ENV FROM BC_HELPER"]
from the log i can see that's actually connecting to db
[2024-06-10 07:35:53] INFO [liquibase.lockservice] Successfully acquired change log lock
[2024-06-10 07:35:53] INFO [liquibase.lockservice] Successfully released change log lock
[2024-06-10 07:35:53] INFO [liquibase.command] Logging exception.
ERROR: Exception Details
[2024-06-10 07:35:53] INFO [liquibase.ui] ERROR: Exception Details
ERROR: Exception Primary Class:  SQLException
[2024-06-10 07:35:53] INFO [liquibase.ui] ERROR: Exception Primary Class:  SQLException
ERROR: Exception Primary Reason: Invalid SQL type: sqlKind = UNINITIALIZED
and if i do an update with a valid changelog, the same 'props.properties' file just work, and update goes flawlessly.
i am just unable to run the "select env fom bc_helper"
bc_helper is a 1 row table, and ENV is a varchar 64
thanks for helping!
Steps To Reproduce
"liquibase", "execute-sql",
"--log-level=INFO",
"--defaultsFile=props.properties",
"--default-schema-name=TEST",
"--delimiter=\",
"--sql="SELECT ENV FROM BC_HELPER""
Expected/Desired Behavior
return the actual data from the table
Liquibase Version
Liquibase Open Source version 4.25.1
Database Vendor & Version
oracle 19c
Liquibase Integration
cli
Liquibase Extensions
oracle extension
OS and/or Infrastructure Type/Provider
No response
Additional Context
No response
Are you willing to submit a PR?

[ ] I'm willing to submit a PR (Thank you!)

Hi @matteo-rama, thank you for reporting this issue.
Are you using Liquibase through a Dockerfile, with the command you've provided as a CMD argument? If so, could you provide your Dockerfile?
This bug isn't reproducible using the regular Liquibase CLI.
Thank you,
Tatiana

no, i am not using docker, just shell.
maybe is the different database the culprit, i am using oracle

Please try using the following syntax:
liquibase execute-sql --log-level=INFO --default-schema-name=TEST --delimiter=\\ --sql="SELECT ENV FROM BC_HELPER"

hi,
did try but without luck :(
that's a piece of log, not sure if it help
[2024-07-08 09:35:51] INFO [liquibase.lockservice] Successfully acquired change log lock
[2024-07-08 09:35:51] INFO [liquibase.lockservice] Successfully released change log lock
[2024-07-08 09:35:51] INFO [liquibase.command] Logging exception.
ERROR: Exception Details
[2024-07-08 09:35:51] INFO [liquibase.ui] ERROR: Exception Details
ERROR: Exception Primary Class:  SQLException
[2024-07-08 09:35:51] INFO [liquibase.ui] ERROR: Exception Primary Class:  SQLException
ERROR: Exception Primary Reason: Tipo SQL non valido: sqlKind = UNINITIALIZED
[2024-07-08 09:35:51] INFO [liquibase.ui] ERROR: Exception Primary Reason: Tipo SQL non valido: sqlKind = UNINITIALIZED
ERROR: Exception Primary Source: Oracle Oracle Database 19c Enterprise Edition Release <IP_ADDRESS>.0 - Production
Version <IP_ADDRESS>.0
[2024-07-08 09:35:51] INFO [liquibase.ui] ERROR: Exception Primary Source: Oracle Oracle Database 19c Enterprise Edition Release <IP_ADDRESS>.0 - Production
Version <IP_ADDRESS>.0
[2024-07-08 09:35:51] INFO [liquibase.command] Command execution complete
[2024-07-08 09:35:51] SEVERE [liquibase.integration] Tipo SQL non valido: sqlKind = UNINITIALIZED [Failed SQL: (17439) "SELECT ENV FROM BC_HELPER"]
liquibase.exception.CommandExecutionException: liquibase.exception.DatabaseException: Tipo SQL non valido: sqlKind = UNINITIALIZED [Failed SQL: (17439) "SELECT ENV FROM BC_HELPER"]
at liquibase.command.CommandScope.execute(CommandScope.java:253)
at liquibase.integration.commandline.CommandRunner.call(CommandRunner.java:55)
and the command you send is exactly what i run, aside that i add --defaultsFile=.....
to add my config file

Hi, I still haven't been able to reproduce this, so I need some more detailed information:

The command you provided has a different syntax than the one I provided, yet you said that you were running the same one I sent. Have you tried with both syntaxes?
The syntax "liquibase", "execute-sql",  ... isn't default for CLI. Are you using PowerShell or any other CMD?
If not, could you provide part of the logs (like you did before) but including the command you ran?
Have you tried using single quotes ' ' instead of double quotes " " around your SQL code?
Lastly, I have a suspicion that the --delimiter=\\ part might be the culprit. Could you try running the command without it?

Thank you,
Tatiana


Increment version for identity releases

Increment package version after release of azure-identity

Same as https://github.com/Azure/azure-sdk-for-cpp/pull/2553#issuecomment-875028659, let's hold off on merging until later in the week.


Refactor FuncLexr to use iterator functions

I am making a minor change to crates/vimfuncs/build.rs.
It doesn't impact the functionality but use more idiomatic iterator. I also made some changes to keep abstraction level consistent. Please let me know if that's too many changes.
Changes:

FuncLexer only has one field chars which is an iterator
FuncToken has a new special token Skip
FuncLexer::lex function delegates processing of characters to other struct methods
Removed enum methods for FuncToken (string, number...) and instead use pattern matching to get enum values

Testing:

cargo run test is green
I used data/global_functions.txt to generate a list of tokens using the original script and the refactored script. They produced identifical content

There's kind of a lot of extra changes in the PR. It's not a huge deal but in general it's nice if the changes can be made smaller so as to be more easily reviewed (for example, some of the name changes and things I don't really like as much as the names that were there before)

There's kind of a lot of extra changes in the PR. It's not a huge deal but in general it's nice if the changes can be made smaller so as to be more easily reviewed (for example, some of the name changes and things I don't really like as much as the names that were there before)

100% agreed. I started making too many changes as part of refactoring.

I cleaned the changes up by

renaming skip_whitespaces to skip_whitespace
revert deletion of FuncToken methods
revert changes to anything outside FuncLexer

I made a new change so that now lex method iterates through characters by peek() instead of next(). See L64. I think this would make the design more flexible to change in the future. Let me know what you think
@tjdevries


Consistent failures in request specs

On different platforms I get consistent failures of certain request specs.

These are the failures on linux.
These are the failures on OS X.

I've had some discussion with @parndt about this in IRC and he sees similar things. I wanted to open this ticket so we could track this and keep the discussion in one place.

Did this get fixed with capybara-webkit 0.8.0?

@parndt unfortunately no.

Like @ugisozols said, it did not.
The spec that fails consistently on linux passes when run alone so it will be hard to isolate:
$ rspec core/spec/requests/refinery/search_spec.rb -l11 -fd
No DRb server is running. Running in local process instead ...
Run options: include {:line_numbers=>[11]}

search
  when searched item exists
    image engine
      returns found image

Finished in 1.82 seconds
1 example, 0 failures

Perhaps the fact that it passes in isolation is a clue

I've moved to selenium instead.


First alibaba cloud ubuntu PR for building stemcell

 Thank you for your submission, we really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.1 out of 2 committers have signed the CLA.:white_check_mark: xiaozhu36:x: ailan-glYou have signed the CLA already but the status is still pending? Let us recheck it.


Multidb support

(This requires #32, and the diff actually will show part of #32 until that is merged in)
Add full multi-db support via --create-all and --execute
This commit does several things:

Migrations can now be read as path/database/migration.

Allowed migration databases are now determined by the router, and nashvegas gets created
on all capable connections to store state for that connection.

A new flag on upgradedb, --create-all was added. This attempt will dump creation migrations
in path for all databases.

The --execute flag will now run against all databases.

The comparedb command now supports the --database argument.

I'd still like to make more improvements, such as bringing in a more South-like interface (e.g. syncdb --migrate, and migrate), as well as incorporate support for the test suite.

Should I merge branches in for both #32 and #33 or are you saying that the branch for #33 includes all of #32?

#33 simply includes #32, so if it were merged #32 would close out as well
You can merge them separate, or just merge #33 :)

Merged, tested locally (I don't have any projects currently with multi-db needs so haven't tested that part of it), and fixed on minor thing to keep things working with migrations at root level. Want to give my changes a quick check to make sure they didn't break what you are doing and i'll publish 0.8 to PyPI.


Hide global bar on the referred page

Replace hardcoded blacklisted paths with the path of the page the call to action link points to.
Follow up on #2057 and #2059.

Ah sorry I didn't realise we had this blocklist.