[Bug] "Clean Networks" deletes protected system network 1panel-network without checking container bindings, leaving all containers unable to start

[EncoTime]

Problem Description

Two related defects in the Container → Networks → "Clean Networks" action (v2.3.1):

1. Contradicts the official docs: the documentation states that none, host, bridge, and 1panel-network are built-in system networks that cannot be deleted, yet "Clean Networks" deletes 1panel-network.
2. No binding check before deletion: it does not check whether any containers (including stopped ones) are attached to the network — no warning, no consequence shown. Afterwards every app container bound to that network fails to start.

An aggravating case: cleanup is still allowed while the Docker daemon is unhealthy. In our incident dockerd was in a crash loop (root cause same family as #13814: ip_forward=0 with firewall-backend: nftables). After clicking "Clean Networks", a zombie network was persisted: docker network ls still shows 1panel-network, but after the daemon recovers, docker run --network 1panel-network fails with network ... does not exist, and attaching new containers to it fails as well. Recovery required a manual docker network rm followed by recreating the network with the original subnet.

Steps to Reproduce

1. Have dockerd in a startup-failure loop (in our case: Debian 13 with net.ipv4.ip_forward=0 and the nftables backend — the [Bug] Switching Container Port Guard backend to nftables causes dockerd to crash on startup when net.ipv4.ip_forward = 0 without pre-check or remediation #13814 scenario)
2. Panel → Containers → Networks → click "Clean Networks"
3. 1panel-network is deleted (at the moment of the click, dockerd logs Error handling plugin refcount operation ... legacy plugin: Unable to find plugin without name)
4. After the daemon recovers, every attached container fails to start:

   failed to set up container networking: failed to create endpoint <name>
   on network 1panel-network: network <id> does not exist
   

5. docker network ls still lists the network (zombie state); docker network rm + recreating it with the same subnet restores service

Expected Behavior

• "Clean Networks" treats 1panel-network as protected per the docs; or at minimum:
• Before deletion, inspect the network's Containers list (including stopped containers) via docker network inspect and block deletion with a clear message when it is non-empty
• Check daemon health before executing the cleanup and abort when the daemon is not healthy

Environment

• OS: Debian 13 (trixie), kernel 6.12
• Docker: 29.8.1, daemon.json contains "firewall-backend": "nftables"
• 1Panel: v2.3.1
• Related: [Bug] Switching Container Port Guard backend to nftables causes dockerd to crash on startup when net.ipv4.ip_forward = 0 without pre-check or remediation #13814 (another defect in the same incident chain)

[wanghe-fit2cloud]

感谢反馈，问题确认：清理网络缺少保护名单和容器占用检查，导致 1panel-network 被误删。我们会在后续版本修复，清理/删除前增加保护与校验。