Please provide repo for docker-ce on Fedora 32

[hhlp]

• This is a bug report
• This is a feature request
• I searched existing issues before opening this one

The Docker-CE Fedora repository is the recommend way to install recommended way. It has many benefits over installing from a package or any other method.

Fedora also releases a new version every six months. The Fedora repository also takes a very long time to become ready after the release of a new version, with many issues being opened after each recent Fedora is release.

Fedora has officially branched Version 32 February 11/2020 and might have a beta release on March 17/2020.

I'm filing this issue to hopefully put this task on the radar, so that there might be a repository set up in time for the Fedora 32 release cycle....

NOTE

Some of us migrate when the beta version is ready so we have to disable the repository and wait for it to be ready

Release Schedule: https://fedorapeople.org/groups/schedule/f-32/f-32-key-tasks.html

Regards.,

[vincent-olivert-riera]

It seems this won't happen on time for tomorrow's release. Perhaps the focus has been put on getting cgroupsv2 working? opencontainers/runc#2315

[kiview]

Just noticed that Docker container have no internet connectivity after upgrade to Fedora 32. User needs to add docker network interface to trusted firewall zone. I hope official package will keep this in mind and configure firewalld accordingly.

[christian-korneck]

I have upgraded my Fedora 31 workstation to Fedora 32. Here are some issues I've experienced with Docker (most of them have been reported by other people above, but I'm trying to give some details).

1.) Since Fedora 31 cgroups v2 is enabled by default. To be able to run Docker you need to revert to cgroups v1 by setting a parameter in the kernel cmdline. (Not a bug, just mentioning it for completeness).

grubby --update-kernel=ALL --args="systemd.unified_cgroup_hierarchy=0"
reboot

2.) There is no Fedora 32 repo for Docker, so updates fail. (I had Docker already installed on Fedora 31).

$ dnf repolist docker-ce-stable --verbose
error: Status code: 404 for http://download.docker.com/linux/fedora/32/repodata/repomd.xml (IP: 13.35.253.112) (http://download.docker.com/linux/fedora/32/repodata/repomd.xml).

3.) there's an iptables issue. From inside a Docker container pinging any destination works. However, tcp/udp connections don't work (i.e. the local DNS server set by Docker in the container can only be pinged, but not reached on the DNS service).

journalctl -t firewalld shows these errors after booting:

firewalld[854]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER' failed: iptables: No chain/target/match by that name.
firewalld[854]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER' failed: iptables: No chain/target/match by that name.
firewalld[854]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER-ISOLATION-STAGE-1' failed: iptables: No chain/target/match by that name.
firewalld[854]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER-ISOLATION-STAGE-1' failed: iptables: No chain/target/match by that name.
firewalld[854]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER-ISOLATION-STAGE-2' failed: iptables: No chain/target/match by that name.
firewalld[854]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER-ISOLATION-STAGE-2' failed: iptables: No chain/target/match by that name.
firewalld[854]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -F DOCKER-ISOLATION' failed: iptables: No chain/target/match by that name.
firewalld[854]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -t filter -X DOCKER-ISOLATION' failed: iptables: No chain/target/match by that name.
firewalld[854]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o docker0 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?).
firewalld[854]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o docker0 -j DROP' failed: iptables: Bad rule (does a matching rule exist in that chain?).

As someone mentioned above, adding the Docker interface to the trusted firewall zone is a quick workaround:

firewall-cmd --permanent --zone=trusted --add-interface=docker0
firewall-cmd --reload

[davidkna]

The networking issues appear to be caused by firewalld switching to nftables. The changeset also has some recommendations for solvings this issue which to also appear to amount to making docker0 part of a trusted zone.

[Bouhnosaure]

I had this same issue and i wasn't able to ping anything within a container, I've fixed it with :

firewall-cmd --get-zone-of-interface=enp1s0
   FedoraWorkstation

firewall-cmd --zone=FedoraWorkstation --add-masquerade --permanent

firewall-cmd --reload

[nlzet]

I had this same issue and i wasn't able to ping anything within a container, I've fixed it with :

firewall-cmd --get-zone-of-interface=enp1s0

   FedoraWorkstation



firewall-cmd --zone=FedoraWorkstation --add-masquerade --permanent



firewall-cmd --reload

another solution for now is changing the firewalld.conf “FirewallBackend” from nftables to iptables

[quackerd]

Changing FirewallBackend to iptables worked for me on CentOS 8 which defaults to nftables like Fedora 32 does. Docker or libnetwork need to support nftables natively.

[KevinAtSesam]

I had trouble connecting to my local Kafka instance after upgrading to Fedora 32. Something with the routing messed up. I could connect to my local webserver, but the webserver could not communicate with Kafka.

I've corrected the issue, in two steps:

• I added the the docker0 interface to the trusted list, as instructed by Please provide repo for docker-ce on Fedora 32 #955 (comment)
• I set masquerading on for my zone FedoraWorkstation, as instructed by Please provide repo for docker-ce on Fedora 32 #955 (comment)

[yrsurya]

while running docker run with --network=host is also worked for me as I don't want to update those firewalls manually. will wait to hear if this can be reolved soon in latest repos which supports fedora32.

[tymokvo]

⬆️ same, and can be achieved in a docker-compose.yml with:

    build:
      network: host

under the appropriate service entries.

[christian-korneck]

running docker run with --network=host is also worked for me

I don't think that's what you usually want. With --network=host you loose container network isolation and your containers have the same interfaces and IPs as the host. (This is useful when you i.e. want to run a packet capture program in a container that should have access to the host's network interface).