• backport: daemon: disallow container port 0 #51684

- What I did

Although container port 0 is invalid, it's currently accepted by the Engine. Users could mistakenly declare -p 0:0 and end up with a port mapping that does nothing. In that case, the Engine would allocate an ephemeral host port and create an iptables / nftables rule that DNAT to container port 0. This is obviously wrong.

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       6    --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:32768 to:172.18.0.2:0

Instead of failing silently, return an error message to the API client when it calls the ContainerCreate endpoint.

- Human readable description for the release notes

Return an error when a container is created with a port-mapping pointing to container port 0.