Issue:
After adding a container interface, “pod-XX”, to a firewall interface group, it disappears from the group upon reboot. The following error is logged in /var/log/vyatta/vyos-boot-config-loader.log for all pod interfaces:

Value validation failed
Set ['firewall' 'group' 'interface-group' 'INT_GROUP' 'interface' 'pod-XX'] failed

Possible solution:

The issue appears to be related to an interface name validation constraint in the following definition:
Interface Name Constraint

To resolve this, the regular expression in interface-name.xml.i can be updated as follows:

Original:

<regex>(bond|br|dum|en|ersp|eth|gnv|ifb|ipoe|lan|l2tp|l2tpeth|macsec|peth|ppp|pppoe|pptp|sstp|sstpc|tun|veth|vti|vtun|vxlan|wg|wlan|wwan)[0-9]+(.\d+)?|lo</regex>

to add pod-[-_a-zA-Z0-9]{1,11} from the constants of the container network.

Proposed:

<regex>(bond|br|dum|en|ersp|eth|gnv|ifb|ipoe|lan|l2tp|l2tpeth|macsec|peth|ppp|pppoe|pptp|sstp|sstpc|tun|veth|vti|vtun|vxlan|wg|wlan|wwan)[0-9]+(.\d+)?|pod-[-_a-zA-Z0-9]{1,11}|lo</regex>

This modification ensures that the “pod-XX” container interface is preserved through reboots.

It appears that T6841 may have inadvertently introduced this change in behavior. T7144 appears to be related as well.