Unable to use nerdctl in rootless mode: iptables not found in $PATH despite installed

[sarunint]

Hi,

I somehow cannot run nerdctl in rootless mode. The error I got is:

sarunint@laptop:~> nerdctl run -it --rm alpine
docker.io/library/alpine:latest:                                                  resolved       |++++++++++++++++++++++++++++++++++++++| 
index-sha256:b95359c2505145f16c6aa384f9cc74eeff78eb36d308ca4fd902eeeb0a0b161b:    done           |++++++++++++++++++++++++++++++++++++++| 
manifest-sha256:3d426b0bfc361d6e8303f51459f17782b219dece42a1c7fe463b6014b189c86d: done           |++++++++++++++++++++++++++++++++++++++| 
config-sha256:bfe296a525011f7eb76075d688c681ca4feaad5afe3b142b36e30f1a171dc99a:   done           |++++++++++++++++++++++++++++++++++++++| 
layer-sha256:ca7dd9ec2225f2385955c43b2379305acd51543c28cf1d4e94522b3d94cce3ce:    done           |++++++++++++++++++++++++++++++++++++++| 
elapsed: 9.5 s                                                                    total:  2.7 Mi (288.8 KiB/s)                                     
FATA[0009] failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error running hook #0: error running hook: exit status 1, stdout: , stderr: time="2022-11-22T19:38:47+07:00" level=fatal msg="failed to call cni.Setup: plugin type=\"bridge\" failed (add): failed to locate iptables: exec: \"iptables\": executable file not found in $PATH"
Failed to write to log, write /home/sarunint/.local/share/nerdctl/1935db59/containers/default/2fa383a19e1cf99c4042d37920f48a423962d36a67df78b2491fb4c8d6aa612b/oci-hook.createRuntime.log: file already closed: unknown

The error mentioned \"iptables\": executable file not found in $PATH", so I checked my system. I have iptables installed, the full-path is /usr/sbin/iptables.

My system is running openSUSE Tumbleweed. nerdctl is installed from official openSUSE repository.

Any help would be appreciated!

Thanks.

[Zheaoli]

Which OpenSUSE version you used?

[sarunint]

openSUSE Tumbleweed, it is a rolling release distribution

[Zheaoli]

Have you ever setup the rootless mode by using script https://github.com/containerd/nerdctl/blob/main/extras/rootless/containerd-rootless.sh?

[sarunint]

I ran using the containerd-rootless-setuptool.sh install. Is that enough?

[LordGnomish]

Hi!

! I have the same issue here, did you solve this problem?

Best,

[LordGnomish]

I also use containerd-rootless-setuptool.sh install

[pedroscaff]

I had the same issue and in my system (debian bullseye) iptables and ip6tables was installed only under /usr/sbin. A quick fix was to make a link in /usr/local/bin:

• ln -s /usr/sbin/iptables /usr/local/bin/iptables
• ln -s /usr/sbin/ip6tables /usr/local/bin/ip6tables

[davidecavestro]

Same for Debian 12/Bookworm

[midnight-wonderer]

For those who want to stay true to the rootless spirit:

ln -s /usr/sbin/iptables ~/.local/bin/iptables
ln -s /usr/sbin/ip6tables ~/.local/bin/ip6tables

To the original asker (@sarunint)

• I am on Tumbleweed, too; the symlinks above work and require no root.
• My name is Sarun, too.

[zgfh]

this work for me （debain 12.2）

apt install iptables

[jeffrson]

So is this a bug in containerd-rootless-setuptool.sh install? Should it create links in ~/.local/bin (given that profile start scripts append that to the PATH) - and remove those in uninstall?

Currently it still seems, rootless setup as documented does not work for most new installations since iptables is located in /usr/sbin (if at all). What is the correct solution?

[jeffrson]

Yes, indeed, if $PATH contains {/usr}/sbin it will work. For me, Debian netinstall, it's /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games, however.

The patch looks fine, but I haven't tried it yet. Will report if done.

[jeffrson]

Well, didn't work, unfortunately. First, it's missing a ':' before /usr/sbin. Then it seems, that os.Environ() overrides those changes.

I'm not a Go developer (yet), so this may not be quite correct, but it works for me anyway :-)

+       env := append(os.Environ(), "PATH=" + os.Getenv("PATH") + ":/usr/sbin:/sbin")

Thank you for looking into it!

[jeffrson]

It seems like this (simpler) patch does it as well:

diff --git a/pkg/cmd/container/create.go b/pkg/cmd/container/create.go
index c727dce0..43579a91 100644
--- a/pkg/cmd/container/create.go
+++ b/pkg/cmd/container/create.go
@@ -568,6 +568,8 @@ func withNerdctlOCIHook(cmd string, args []string) (oci.SpecOpts, error) {
        }

        args = append([]string{cmd}, append(args, "internal", "oci-hook")...)
+       // sbin is appended for iptables https://github.com/containerd/nerdctl/discussions/1536
+       os.Setenv("PATH", os.Getenv("PATH") + ":/usr/sbin:/sbin")
        return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error {
                if s.Hooks == nil {
                        s.Hooks = &specs.Hooks{}

[AkihiroSuda]

Thanks for testing, opened a PR (v2.1.0) to fix the issue

• oci-hook: add /usr/sbin:/sbin to PATH for iptables #4208

[AkihiroSuda]

I avoided os.Setenv as I did't like altering the env in the halfway of the nerdctl create steps