dockerd: boot() calls uciadd() triggering reload_config which causes fw4 "redefinition of symbol 'docker_devices'" error on every boot

Package Name

dockerd

Maintainer

Gerard Ryan (G.M.Ryan) gerard@ryanr.co.uk

OpenWrt Version

25.12.4

OpenWrt Target/Subtarget

rockchip/armv8

Steps to Reproduce

1. Install dockerd and configure iptables=0 in /etc/config/dockerd
2. Ensure a firewall zone named docker already exists in /etc/config/firewall (created by uciadd() on first install)
3. Reboot OR run /etc/init.d/firewall stop && /etc/init.d/firewall start
4. Observe error: Error: redefinition of symbol 'docker_devices' during fw4 start

Actual Behaviour

After power loss or manual restart, fw4 fails to apply rules due to docker_devices symbol redefinition. The firewall remains active with no instances. Running /etc/init.d/dockerd boot triggers uciadd() → reload_config → fw4 tries to redefine already-existing nftables symbol, which fails. Removing and reinstalling dockerd packages temporarily "fixes" it because pre/post scripts recreate the firewall zone, but the issue returns after the next reboot.

Root cause: boot() in /etc/init.d/dockerd unconditionally calls uciadd(), which calls reload_config. Since dockerd starts after fw4 (S99 vs S19), fw4 already has its rules loaded. reload_config triggers fw4 to re-apply its ruleset incrementally, but fw4 uses nft -f (not nft flush ruleset first), causing redefinition of symbol 'docker_devices' because docker_devices is already defined by the previously applied ruleset.

When iptables=0, the iptables management is skipped, but uciadd() still runs unconditionally in boot(), still calling reload_config, still triggering the fw4
reload, causing the same error.

Workaround: Commenting out uciadd in boot() and cleaning up duplicate firewall zones resolves the issue.

Expected Behaviour:

boot() should either:

• Not call uciadd() if the docker firewall zone already exists, OR
• Check iptables config option before calling uciadd(), OR
• Move uciadd() to start_service() and only call it on first install, not on every boot

Confirmation Checklist

• The package is maintained in this repository.
• I understand that issues related to the base OpenWrt repository or LuCI repository will be closed.
• I am reporting an issue for OpenWrt, not an unsupported fork.

Start with /etc/init.d/dockerd, especially boot() and uciadd(), and trace how reload_config is invoked when iptables=0 and when the docker firewall zone already exists. Compare the service lifecycle with fw4 startup order. Done means repeated boots or firewall restarts no longer produce the docker_devices redefinition error while required firewall setup still works.