Cloudron Forum

Hello Cloudron Team,

I'm experiencing critical issues with my Cloudron installation following an automatic update. The Cloudron dashboard is no longer allowing me to log in, the firewall service is failing, and Docker containers cannot establish outbound internet connections.

I've performed extensive troubleshooting and would appreciate guidance on safely restoring the server without losing application data.

1. Server information

• Cloudron: 10.1.5
• OS: Ubuntu 24.04 LTS
• Kernel: 6.8.0-147-generic
• Docker: 29.6.2
• Docker firewall backend: iptables
• Hosting provider: Contabo (KVM VPS)
• Dashboard: https://my.baskethunt.com

Docker 29.6.2 was installed on September 13, 2026, and kernel 6.8.0-147 was installed on October 14, 2026.

2. Cloudron dashboard login failure

After the automatic update, the login page loads successfully, but submitting my credentials produces:

Internal error, try again later

The Cloudron box log contains:

HttpError: Unknown column 'inviteTokenCreationTime' in 'field list'
SQL Error: ER_BAD_FIELD_ERROR (1054)

Running cloudron-support --troubleshoot shows:

PASS: 32
WARN: 0
FAIL: 1
SKIP: 0

[FAIL] Database migrations are pending.

Last migration in DB:
20260908124000-appPasswords-add-ownerId.js

Last migration file:
20261009112100-oidcClients-add-allowTokenExchange.js

I attempted:

sudo cloudron-support --apply-db-migrations

However, the process failed while starting the firewall service:

Job for cloudron-firewall.service failed
[FAIL] Database migrations failed

3. Cloudron firewall service failure

Running systemctl status cloudron-firewall.service produces:

iptables: Bad rule (does a matching rule exist in that chain?).
ip6tables: Bad rule (does a matching rule exist in that chain?).
iptables: No chain/target/match by that name.

cloudron-firewall.service:
Failed with result 'exit-code'

The firewall startup script attempts to insert rules into DOCKER-USER, but this chain appears to be unavailable when Cloudron tries to use it.

4. Missing Docker firewall and NAT rules

I checked Docker's networking configuration.

Docker reports:

Firewall Backend: iptables

However:

sudo iptables -t nat -S

Returns only:

-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT

No Docker NAT/MASQUERADE rules are present.

Additionally, iptables-legacy NAT and filtering checks showed no Docker-managed rules.

I restarted Docker using:

sudo systemctl restart docker

Immediately afterward, the DOCKER-USER chain appeared:

-N DOCKER-USER

But subsequent checks showed that the chain was missing again.

Restarting cloudron-firewall.service still fails with the same error.

I have not manually flushed the firewall, switched iptables backends, or edited Docker configuration files.

5. Docker container internet connectivity failure

My Chatwoot installation is also affected.

Outgoing WhatsApp messages, including approved templates, remain stuck on "Sending."

Chatwoot's Sidekiq jobs report:

SendReplyJob
Channels::Whatsapp::TemplatesSyncJob

Net::OpenTimeout:
Failed to open TCP connection to
graph.facebook.com:443 (execution expired)

Connectivity tests show:

• The Ubuntu host successfully reaches Google and Meta's Graph API.
• The Chatwoot container times out connecting to both.
• IPv4-only connections also time out inside Chatwoot.
• IPv4 forwarding is enabled.
• The br_netfilter module is loaded.
• Both bridge-nf-call-iptables and bridge-nf-call-ip6tables are enabled.

This appears to be a broader Docker container networking issue rather than a WhatsApp configuration issue.

6. Additional checks completed

I've also verified that:

• box.service is running.
• Docker is running.
• UFW is inactive.
• nftables.service is disabled and inactive.
• netfilter-persistent.service is not installed.
• The Docker cloudron bridge network is not marked internal.
• /etc/docker/daemon.json does not exist.
• Docker's systemd Cloudron override is present.
• The Docker logs show successful daemon initialization.

7. Assistance requested

Could you please help determine:

1. Why Docker's firewall and NAT rules are missing or disappearing?
2. Why cloudron-firewall.service cannot initialize?
3. Whether the current Docker and Cloudron versions have a known compatibility issue?
4. What is the recommended recovery procedure to complete the pending database migrations and restore dashboard login?
5. How can we restore outbound connectivity to Cloudron-hosted applications?

This is an active server, so preserving application data and minimizing downtime are important.

I can provide additional logs, screenshots, and diagnostic information if required.

Thank you for your assistance.