iptables-legacy -t nat support?

[johnwmail]

Description

I have the issue with NAT rule, when I run dockerd in gvisor( with --net-raw enable).
the container in second level docker can't connect outside network at all, any idea how to make it connect outside network?
I want run dind as a ci pipeline runner in gvisor.

Steps to reproduce

No response

runsc version

docker version (if using docker)

uname

No response

kubectl (if using Kubernetes)

repo state (if built from source)

No response

runsc debug logs (if available)

[kevinGC]

gVisor doesn't support the masquerade target yet, which is what causes this error.

Notably, the logic is mostly implemented in //pkg/tcpip/stack/iptables_targets.go:MasqueradeTarget, but support would need to be added to //pkg/sentry/socket/netfilter so that iptables-legacy can actually install masquerade rules.

[ilaypilo]

Are there any plans to fix this issue?

[avagin]

Are there any plans to fix this issue?

We don't have any plans to implement it in a near future.