From 36ea71aadc5ceb342075b089df0e7a430339a664 Mon Sep 17 00:00:00 2001
From: emil <emil@oblachno.fyi>
Date: Fri, 14 Aug 2026 20:42:11 +0200
Subject: [PATCH] DEVX-155: fix: add --iptables=false to local dockerd

The new dockerd fails with 'iptables: Permission denied' because it
can't create NAT chains. Disable iptables since molecule tests don't
need network isolation.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 src/devx/molecule/start_docker.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/devx/molecule/start_docker.py b/src/devx/molecule/start_docker.py
index dcba628..1e73879 100644
--- a/src/devx/molecule/start_docker.py
+++ b/src/devx/molecule/start_docker.py
@@ -252,6 +252,7 @@ def start_docker_daemon(timeout: int = DEFAULT_TIMEOUT) -> bool:
             "vfs",
             "--data-root",
             docker_data_root,
+            "--iptables=false",
             "-H",
             f"unix://{local_sock}",
         ],