Docker "failed to create endpoint ... iptables" - Fix Networking Setup in CI

Docker could not wire a container onto a network because programming the iptables/netfilter rules failed. The bridge networking setup the container needs could not be created.

What this error means

A docker run or docker compose up fails to start a container with failed to create endpoint ... iptables failed: .... It is environment-specific - common after the host’s iptables state was reset or in a constrained/nested runner.

docker run output

Error response from daemon: failed to create endpoint web on network bridge:
iptables failed: iptables --wait -t nat -A DOCKER ...: iptables: No chain/target/match
by that name.

Common causes

Docker’s iptables chains are missing or stale

If something flushed iptables (a firewall reload, another tool) the DOCKER chains Docker expects are gone, so adding the per-container rule fails.

iptables disabled or unavailable in the environment

A nested/constrained runner without the needed netfilter modules, or a daemon started with --iptables=false, cannot program the endpoint.

Conflicting firewall manager

A host firewall manager (firewalld/ufw) that owns iptables can fight Docker’s rules, leaving the chains in a state Docker cannot extend.

How to fix it

Restart Docker to rebuild its iptables chains

A daemon restart re-creates the DOCKER chains and base NAT rules.

Terminal

sudo systemctl restart docker
# verify Docker's chains exist again
sudo iptables -t nat -L DOCKER -n

Ensure netfilter is available and not overridden

Confirm the daemon is not started with --iptables=false unless you manage rules yourself.
Load required modules (br_netfilter, iptable_nat) in the environment.
Reconcile a host firewall manager so it does not flush Docker’s chains.

How to prevent it

Avoid flushing iptables out from under a running Docker daemon.
Keep br_netfilter/NAT modules available on runner hosts.
Coordinate any host firewall manager with Docker’s rule ownership.