From 4d2e38f616c9e94c15563da8e0b753964ff44bf9 Mon Sep 17 00:00:00 2001
From: anti <samuel@securejump.cl>
Date: Mon, 20 Apr 2026 23:19:42 -0400
Subject: [PATCH] fix(network): sweep orphan Docker bridges that squat on our
 subnet
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A prior half-torn-down topology can leave a bridge network alive under
a different name that still owns our intended subnet.  Docker then
rejects our create with 'Pool overlaps with other one on this address
space', and the topology deploy fails.

Extend create_bridge_network to sweep any unused bridge whose IPAM
subnet matches the one we're about to claim (skipping networks with
running containers — those are live use).
---
 decnet/network.py | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/decnet/network.py b/decnet/network.py
index 30f9659b..c150071e 100644
--- a/decnet/network.py
+++ b/decnet/network.py
@@ -256,6 +256,24 @@ def create_bridge_network(
                 pass
         net.remove()
 
+    # Orphaned networks from a prior half-torn-down topology can still
+    # claim the subnet under a different name — Docker then rejects our
+    # create with "Pool overlaps".  Sweep any unused bridge that sits on
+    # the same subnet and owns no running containers.
+    for net in client.networks.list(filters={"driver": "bridge"}):
+        if net.name == name:
+            continue
+        pools = (net.attrs.get("IPAM") or {}).get("Config") or []
+        cur = pools[0] if pools else {}
+        if cur.get("Subnet") != subnet:
+            continue
+        if net.attrs.get("Containers"):
+            continue
+        try:
+            net.remove()
+        except docker.errors.APIError:
+            pass
+
     net = client.networks.create(
         name=name,
         driver="bridge",