gitea 6d2ca9ea57 fix: use iptables-nft so rules land in the same table Docker uses ...

Hosts running Docker with the default Debian/Ubuntu iptables use the
nf_tables backend (iptables-nft). Inserting rules via iptables-legacy
created them in a separate, unreferenced table — bans were recorded in
fail2ban but packets were never dropped.

Switching action commands to iptables-nft writes into the same
DOCKER-USER chain that Docker manages, so bans take effect immediately.
Also reverts the update-alternatives override from the Dockerfile since
it is no longer needed (and generated noisy warnings).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-02-20 17:29:33 +00:00

3.7 KiB

Raw Blame History

View Raw