Skip to content

Remove iptables-persistent package#28596

Draft
saiarcot895 wants to merge 1 commit into
sonic-net:masterfrom
saiarcot895:fix-docker-iptables-inconsistency
Draft

Remove iptables-persistent package#28596
saiarcot895 wants to merge 1 commit into
sonic-net:masterfrom
saiarcot895:fix-docker-iptables-inconsistency

Conversation

@saiarcot895

@saiarcot895 saiarcot895 commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Iptables rules are not meant to be persistent across reboots.

Why I did it

Fixes sonic-net/sonic-mgmt#26179

Work item tracking
  • Microsoft ADO (number only):

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

  • 202305
  • 202311
  • 202405
  • 202411
  • 202505
  • 202511
  • 202512
  • 202605
  • 202608

Tracking issue/work item for backport/cherry-pick request (GitHub issue or Microsoft ADO):
Failure type:

Tested branch

  • master
  • 202305
  • 202311
  • 202405
  • 202411
  • 202505
  • 202511
  • 202512
  • 202605
  • 202608
  • N/A

Test result

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

Iptables rules are not meant to be persistent across reboots.

Signed-off-by: Saikrishna Arcot <sarcot@microsoft.com>
Copilot AI review requested due to automatic review settings July 23, 2026 06:25
@mssonicbld

Copy link
Copy Markdown
Collaborator

/azp run Azure.sonic-buildimage

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Removes the iptables-persistent package from the base Debian host image installation list in build_debian.sh, aligning the image with the stated goal that iptables rules should not persist across reboots.

Changes:

  • Drops iptables-persistent from the chroot apt-get install package set for the host filesystem.

Comment thread build_debian.sh
Comment on lines 340 to 343
efibootmgr \
usbutils \
pciutils \
iptables-persistent \
ebtables \
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[dualtor][KVM] test_mux_port_iptables_entries intermittently misses Docker IPv6 NAT rules

3 participants