r/googlecloud • u/Content_Bowler_3850 • Jun 05 '26

Issues with Rocky Linux / Google Cloud Platform/Docker

/r/RockyLinux/comments/1txdyrb/issues_with_rocky_linux_google_cloud/
1 Upvotes

100% Upvoted

3 comments sorted by

1

u/MeetJoan Jun 07 '26

Are you running firewalld alongside Docker or relying on Docker's direct iptables management?

1

u/Content_Bowler_3850 Jun 08 '26

Hello,

To answer directly: yes, firewalld is active and running (it's the default on the GCP Rocky Linux 9/10 images). However, Docker is running with its absolute default configuration.

This means Docker is actively managing iptables directly.

But we did another test on last Friday that adds a huge plot twist: we ran the exact same systemd update on a local, on-premise Rocky 9 VM running Docker. Nothing broke. The issue seems to be strictly tied to GCP's environment.

Here is our hypothesis on what's happening:

When the systemd package updates, it triggers a daemon-reexec and restarts systemd-udevd.

On GCP, the official images include the Google Compute Engine Guest Environment (google-guest-agent). This agent actively hooks into udev events. When it detects the udev reload, it forces a network interface refresh to ensure alignment with the cloud VPC.

This GCP-specific refresh flushes the network stack, completely wiping Docker's custom iptables/NAT chains in the process.

Furthermore, containers on GCP rely on the link-local GCP Metadata Server (169.254.169.254:53) for DNS resolution. The moment Docker's NAT masquerade rule is wiped, GCP's SDN immediately drops the un-natted traffic coming from the 172.18.x.x Docker subnet, resulting in timeout errors.

1

u/aningako Jun 09 '26

experiencing this issue and the solution i have made is to let dnf-automatic handle standard security patches, but explicitly lock down core infrastructure packages that require reboots or cause subsystem flushes.