[27.x backport] Fix: setup user chains even if there are running containers

[robmry]

• backport Fix: setup user chains during libnetwork controller initialization #48577

fixes #48560

Currently, the DOCKER-USER chains are set up when the firewall is reloaded or when a network is created:

moby/libnetwork/controller.go

Lines 709 to 715 in 4001d07

	// Sets up the DOCKER-USER chain for each iptables version (IPv4, IPv6)
	// that's enabled in the controller's configuration.
	for _, ipVersion := range c.enabledIptablesVersions() {
	if err := setupUserChain(ipVersion); err != nil {
	log.G(context.TODO()).WithError(err).Warnf("Controller.NewNetwork %s:", name)
	}
	}

During a normal startup, the daemon creates the bridge network, so the DOCKER-USER chains are set up.

But when live-restore is enabled, there may be running containers when the daemon starts. If that's the case, the configureNetworking function will not be called:

moby/daemon/daemon_unix.go

Lines 848 to 852 in 4001d07

	if len(activeSandboxes) > 0 {
	log.G(context.TODO()).Info("there are running containers, updated network configuration will not take affect")
	} else if err := configureNetworking(daemon.netController, cfg); err != nil {
	return err
	}

configureNetworking calls initBridgeDriver, which calls NewNetwork, which calls setupUserChain, so if configureNetworking isn't called the user chains won't be set up.

This is a problem if the iptables rules change while the daemon is stopped.

- What I did

I made sure the user chains are set up on startup, even if the configureNetworking function is not called

- How I did it

I put the logic for setting up user chains for IPv4 and IPv6 in a separate function, which is called in the original place in NewNetwork, but also in initNetworkController even if there are running containers.

- How to verify it

I still didn't write an integration test, I'll add it when I have some time.

To manually test:

• dockerd --live-restore
• Create a dummy container: docker run -d busybox sleep 300
• Stop dockerd
• Flush the FORWARD chain: iptables -F FORWARD
• Run again dockerd --live-restore
• List the rules: iptables -S FORWARD

-A FORWARD -j DOCKER-USER should be there

- Description for the changelog

After a daemon restart with live-restore, ensure an iptables jump to the DOCKER-USER chain is placed before other rules.

- A picture of a cute animal (not mandatory but encouraged)