-
Notifications
You must be signed in to change notification settings - Fork 3.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
dockerd compatibility problem with nftables #17766
Comments
What is the exact compatibility problem you are referring to in the title? Docker works on all major Linux distributions, all of them being NFT for few years now. |
@brada4 should be transitioned to nftables use, iptables will slowly be phased out |
Thanks for the thought-provoking question, I'm moving house ATM so I haven't had much time to look into this. |
Docker supports iptables command line only. Enough is emulated via NFT iptables wrappers on any (?other?) system out there. |
It seems that docker still depends on It does sound like a possible feature to remove any So from my perspective, this issue is a duplicate of #16818 |
In the official post iptables-nft is recommended as a compatibility option, on par with what official docker package repos do. (podman too, before you ask) |
iptables-nft is not the best solution, nft has other new features |
I'm not sure to what you are referring to, if you have links I'd appreciate them. |
My Docker container has access to the local network but not the internet when use |
There should be forward rule for each exposed port and one for all masquerade rule involving docker's internal bridge (in iptables-save) |
With nftables you now have multiple tables, if a rule in fw4 table drop a packet, |
centos8-tables.txt Yes, I flushed tables before restarting docker so that it shows only docker additions. |
@brada4 you just don't have any firewall configured on your CentOS8 box |
It's an issue for me as well. For docker-compose it's avoidable by manually creating bridges (in my example it's br-transmission) and doing
After these two commands the containers have normal connectivity. For Yes, I'm using iptables-nft. |
@G-M0N3Y-2503 @neheb
In the future, iptables will be replaced. Will dockerd be perfectly compatible with nftables?
The text was updated successfully, but these errors were encountered: