Make puppetlabs-firewall works with docker smoothly

puppet-firewall-docker.pp

  class my_fw::pre {

# Disable due to selective purges of firewallchain
#    resources { "firewall":
#      purge => true
#    }

    # Avoid removing Docker rules:
    firewallchain { 'FORWARD:filter:IPv4':
      purge  => true,
      ignore => [ 'docker' ],
    }
    firewallchain { 'DOCKER:filter:IPv4':
      purge  => false,
    }
    firewallchain { 'DOCKER:nat:IPv4':
      purge  => false,
    }
    firewallchain { 'POSTROUTING:nat:IPv4':
      purge  => true,
      ignore => [ 'docker', '172.17' ],
    }
    firewallchain { 'PREROUTING:nat:IPv4':
      purge  => true,
      ignore => [ 'DOCKER' ],
    }

    #ensure input rules are cleaned out
    firewallchain { 'INPUT:filter:IPv4':
      ensure => present,
      purge  => true,
    }
    
    # Block what ever.....
  }

Really appreciate, i also needed to add OUTPUT:filter:IPv4 with the same ignore from FORWARD:filter:IPv4

Thanks for this. It did not quite work for me, DOCKER-USER, DOCKER-INGRESS and DOCKER-ISOLATION-STAGE-1 rules were being deleted from the FORWARD chain. I changed all ignore to a regexp that matches rules starting with docker, case insensitive:
ignore => [ '[^"]*(?i:docker)[^"]*' ],

Thanks for all your inspiration, this seems working in 2023:

# Avoid removing Docker rules:
firewallchain { 'FORWARD:filter:IPv4':
  purge  => true,
  ignore => [ '[^"]*(?i:docker)[^"]*', 'br-' ],
}
firewallchain { 'OUTPUT:filter:IPv4':
  purge  => true,
  ignore => [ '[^"]*(?i:docker)[^"]*' ],
}
firewallchain { 'DOCKER:filter:IPv4':
  purge  => false,
}
firewallchain { 'DOCKER:nat:IPv4':
  purge  => false,
}
firewallchain { 'POSTROUTING:nat:IPv4':
  purge  => true,
  ignore => [ '[^"]*(?i:docker)[^"]*', '172.' ],
}
firewallchain { 'PREROUTING:nat:IPv4':
  purge  => true,
  ignore => [ '[^"]*(?i:docker)[^"]*' ],
}

# Ensure input rules are cleaned out
firewallchain { 'INPUT:filter:IPv4':
  ensure => present,
  purge  => true,
}

cool! thanks for sharing! I miss Puppet's power.