docker_service: build ferm rules with a filter plugin - #2766

Open and close a devnull file descriptor by hand where the standard
library already provides one. Verified the script still collects
containers and still swallows daemon errors into
containers_query_error.

Generated-By: LLM

The scope playbook imported docker_service without deriving the ferm rules
the role computes, so published_ports allow lists had nothing behind them
when the scope playbook was used.

The ferm role stays out of scope here: applying it would reconcile the
whole host firewall, which belongs to the service playbook. Deriving the
variables keeps them available without widening what a scope run touches.

Generated-By: LLM

The variable is rebuilt by build_ferm_vars on every run, so assigning
it in inventory is silently discarded. Saying so avoids the guesswork.

Generated-By: LLM

The task looped over the service definitions a second time and then
rebuilt a list of all non-directory paths for every single volume, so
the cost grew with the square of the number of volumes. It also
repeated the state, create_volume_dirs and absolute path conditions
that the stat task had already applied.

Looping over the stat results and reading item.stat directly removes
the quadratic list rebuild and the duplicated conditions, while
keeping the config_files, data_dirs and existing non-directory
exclusions unchanged.

Generated-By: LLM

The docs claimed reject sends a TCP reset or an ICMP admin-prohibited
reply, which read as a per-protocol choice. The reply type is chosen
from the protocol, so state the mapping instead and explain why TCP
should not be answered with ICMP.

Generated-By: LLM

Generated-By: LLM

The action mapping treated any value other than 'reject' as 'drop', so
a typo such as 'rejectt' closed the published port silently and the
symptom looked like a firewall problem rather than a bad inventory
value. Map the supported actions explicitly and report the rest.

Also correct the action_default documentation, which repeated the
stale claim that reject sends a TCP reset or an ICMP reply; the reply
type follows the protocol.

Generated-By: LLM

The docs described only the service playbook, so there was no record that a
scope playbook exists. Add the entry point section used by the other roles
and list the scope playbook in the man page synopsis.

Generated-By: LLM