Switch over to xtables-legacy when nf_tables module isn't available #465
Conversation
PR docker-library#461 updated Alpine to 3.19 and made a change to load the nf_tables kernel module if needed. However, as demonstrated by docker-library#463 and docker-library#464 this might break when the host system doesn't have the nf_tables module available. In that case, we should still try to load the ip_tables module and symlink /sbin/iptables to xtables-legacy-multi. Signed-off-by: Albin Kerouanton <albinker@gmail.com>
|
Nice, thanks for working on this! ❤️ Modifying |
tianon
force-pushed
the
fix-nf_tables
branch
2 times, most recently
from
6a47f67
to
e360b4d
Compare
| if ! modprobe nf_tables; then | ||
| modprobe ip_tables || : | ||
| # see https://github.com/docker-library/docker/issues/463 (and the dind Dockerfile where this directory is set up) | ||
| export PATH="/usr/local/sbin/.iptables-legacy:$PATH" |
There was a problem hiding this comment.
A nice side benefit of this method is that users having trouble with it misfiring (somehow) is that they can just hide this directory somehow like bind-mounting /dev/null on top of it, and the container will happily continue using the default Alpine-provided iptables symlink. 👍
tianon
force-pushed
the
fix-nf_tables
branch
from
e360b4d
to
ff86294
Compare
/ # ls /usr/local/
bin lib sharegrumble grumble grumble |
…ed symlink farm instead of symlinking over package-provided files in /sbin/ at runtime
tianon
force-pushed
the
fix-nf_tables
branch
from
ff86294
to
cadf44c
Compare
Changes: - docker-library/docker@7ac5702: Switch over to xtables-legacy when nf_tables module isn't available (docker-library/docker#465)
|
Follow-up in #468 👀 |
Changes: - docker-library/docker@7ac5702: Switch over to xtables-legacy when nf_tables module isn't available (docker-library/docker#465)
PR #461 updated Alpine to 3.19 and made a change to load the nf_tables kernel module if needed. However, as demonstrated by #463 and #464 this might break when the host system doesn't have the nf_tables module available. In that case, we should still try to load the ip_tables module and symlink /sbin/iptables to xtables-legacy-multi.