---
vision_firewall::forward_policy: 'drop'
vision_firewall::ignore_purge:
  - '-m (?i:physdev)'
  - '-j DOCKER'
  - '-j DOCKER-ISOLATION'
  - '-j MASQUERADE'
  - '-o docker0'
  - '-i docker0'

lookup_options:
  vision_firewall::system_rules:
    merge:
      strategy: deep
      merge_hash_arrays: true
  vision_firewall::export_rules:
    merge:
      strategy: deep
      merge_hash_arrays: true

---
vision_firewall::forward_policy: 'drop'
vision_firewall::ignore_purge:
  - '-m (?i:physdev)'
  - '-j DOCKER'
  - '-j DOCKER-ISOLATION'
  - '-j DOCKER-ISOLATION-STAGE-1'
  - '-j DOCKER-ISOLATION-STAGE-2'
  - '-j DOCKER-INGRESS'
  - '-j MASQUERADE'
  - '-o docker0'
  - '-i docker0'
  - '-o docker_gwbridge'
  - '-i docker_gwbridge'
  
lookup_options:
  vision_firewall::system_rules:
    merge:
      strategy: deep
      merge_hash_arrays: true
  vision_firewall::export_rules:
    merge:
      strategy: deep
      merge_hash_arrays: true

Make firewall play nicely with Docker Swarm
Make firewall play nicely with Docker Swarm

Docker Swarm creates an additional bridge 'docker_gwbridge' and additional chains 'DOCKER-ISOLATION-STAGE-{1,2}' and 'DOCKER-INGRESS' for its networking.
The firewall module should not purge these rules.