[Bug]: container k8s create fails when node preparation invokes iptables-nft

[matteobisi]

I have done the following

• I have searched the existing issues
• I reproduced this with the current release

Steps to reproduce

container system start
container k8s create --name sighup-local --cpus 6 --memory 16g

Current behavior

Cluster creation fails after the node starts and kubeadm init begins:

Preparing node: ["id": sighup-local]
[2/2] Running kubeadm init [3s]
Error: node prep failed on sighup-local: net.ipv4.ip_forward = 1
registry.k8s.io/pause:3.10.1

The failed node remains running. The plugin's node-preparation path uses iptables-nft, which cannot access the nftables ruleset in the default node kernel:

container exec sighup-local /usr/sbin/iptables-nft -t mangle -S

iptables v1.8.11 (nf_tables): Could not fetch rule set generation id: Invalid argument

Within the node, /usr/sbin/iptables resolves to the nft backend; /usr/sbin/iptables-legacy is also present.

Expected behavior

container k8s create should finish its node preparation and create a usable cluster. The plugin should either use the available legacy backend when nftables is unavailable or ensure that its default node kernel supports the nftables operations it invokes.

Environment

macOS 26.6.1 (25G76), arm64
container CLI version 1.2.2 (release, commit 0190097)
container-apiserver version 1.2.2 (release, commit 0190097)

Related issue

#1002 documented the same nf_tables kernel limitation for Docker inside a container. That issue is closed and predates the Kubernetes plugin. This report covers the current container k8s node-preparation path.

[matteobisi]

Additional diagnostic context, not a proposed fix:

My local lab helper treats this as the specific iptables-nft failure only: it verifies that /etc/kubernetes/admin.conf is absent and that this probe fails:

container exec sighup-local /usr/sbin/iptables-nft -t mangle -S

It can then complete the otherwise interrupted bootstrap after installing the two TCP MSS rules through the legacy backend:

/usr/sbin/iptables-legacy -t mangle -A OUTPUT -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1220
/usr/sbin/iptables-legacy -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1220

The helper subsequently performs kubeadm init, applies the kindnet manifest pinned by Container 1.2.2, and removes the single-node control-plane taint. The complete diagnostic recovery path is available here:

https://github.com/matteobisi/fury-apple-container/blob/054eff2/scripts/bootstrap-cluster.sh

This is only evidence that the failure is isolated to the plugin's node-preparation path selecting iptables-nft in an environment where the legacy backend works. It is not intended as a supported workaround or a recommendation for the implementation; the plugin should determine the appropriate durable behavior.