From c898722818a8ecb3196c4995c440285d9fb5064f Mon Sep 17 00:00:00 2001
From: ssongliu <sloooop1x@gmail.com>
Date: Thu, 27 Aug 2026 10:33:58 +0800
Subject: [PATCH] feat: improve firewall backend synchronization

---
 agent/utils/firewall/docker_guard/manager.go  |  2 +-
 .../firewall/docker_guard/manager_test.go     | 20 +++++++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/agent/utils/firewall/docker_guard/manager.go b/agent/utils/firewall/docker_guard/manager.go
index d2a86b184ad7..6dbc8774deac 100644
--- a/agent/utils/firewall/docker_guard/manager.go
+++ b/agent/utils/firewall/docker_guard/manager.go
@@ -215,7 +215,7 @@ func (m *Manager) Cleanup() error {
 		if err != nil {
 			return err
 		}
-		rules := dockerGuardLifecycleRules(output, false, chainDeclared(output, Chain))
+		rules := dockerGuardLifecycleRules(output, false, false)
 		if len(rules) == 0 {
 			continue
 		}
diff --git a/agent/utils/firewall/docker_guard/manager_test.go b/agent/utils/firewall/docker_guard/manager_test.go
index e4d48d291123..6c828e27ebf0 100644
--- a/agent/utils/firewall/docker_guard/manager_test.go
+++ b/agent/utils/firewall/docker_guard/manager_test.go
@@ -189,6 +189,26 @@ func TestDockerGuardLifecycleRulesBatchCreateAndRebind(t *testing.T) {
 	}
 }
 
+func TestCleanupRemovesExistingChainWithoutRecreatingIt(t *testing.T) {
+	runner := &recordingRunner{}
+	manager := NewManagerWithRunner(runner)
+	if err := manager.Cleanup(); err != nil {
+		t.Fatal(err)
+	}
+	if len(runner.restoreCalls) != 1 {
+		t.Fatalf("restore calls = %d, want 1", len(runner.restoreCalls))
+	}
+	script := runner.restoreCalls[0].input
+	if strings.Contains(script, "-N "+Chain+"\n") {
+		t.Fatalf("cleanup must not recreate the existing chain:\n%s", script)
+	}
+	for _, want := range []string{"-F " + Chain + "\n", "-X " + Chain + "\n"} {
+		if !strings.Contains(script, want) {
+			t.Fatalf("cleanup restore is missing %q:\n%s", want, script)
+		}
+	}
+}
+
 func TestReconcileReturnsChainInspectionError(t *testing.T) {
 	manager := NewManagerWithRunner(&recordingRunner{runErr: errors.New("inspect failed")})
 	err := manager.Reconcile(nil)