Rootless setup: check for module nf_tables by robmry · Pull Request #49727 · moby/moby

robmry · 2025-04-01T16:53:33Z

- What I did

fix RHEL/CentOS Stream 10 does not include the iptables kernel module #49020

CentOS 10 uses iptables-nft by default, and doesn't have kernel module ip_tables - so dockerd-rootless-setuptool.sh reports that the module is missing. It suggests installing it (which isn't needed), or using --skip-iptables (which disables iptables in daemon config).

- How I did it

Unless the iptables --version command reports legacy, check for kernel module nf_tables instead of ip_tables.

- How to verify it

Ran the install script on a CentOS Stream 10 VM, it worked normally with these changes.

(Not tested on RHEL10 as I don't have a license.)

On a Debian host, where I could switch between iptables-nft and iptables-legacy - with kernel module ip_tables unloaded ("rlk_setup.sh" was my modified version of the script) ...

robm@debian:~$ /usr/sbin/iptables --version
iptables v1.8.9 (legacy)
robm@debian:~$ ./rlk_setup.sh install
[ERROR] Missing system requirements. Run the following commands to
[ERROR] install the requirements and run this tool again.
[ERROR] Alternatively iptables checks can be disabled with --skip-iptables .

########## BEGIN ##########
sudo sh -eux <<EOF
# Load ip_tables module
modprobe ip_tables
EOF
########## END ##########

Switched to iptables-nft, with ip_tables still not loaded, then ...

robm@debian:~$ /usr/sbin/iptables --version
iptables v1.8.9 (nf_tables)
robm@debian:~$ ./rlk_setup.sh install
[INFO] Creating /home/robm/.config/systemd/user/docker.service
[INFO] starting systemd service docker.service
...

- Human readable description for the release notes

- Fix an issue preventing rootless Docker setup on a host with no `ip_tables` kernel module.

thaJeztah · 2025-04-03T09:55:27Z

contrib/dockerd-rootless-setuptool.sh

+	iptables_module="nf_tables"
+	if [ -n "$(echo $iptables_version | grep "legacy" 2> /dev/null)" ]; then
+		iptables_module="ip_tables"
+	fi


Probably don't need to grep here if we use a switch;

Suggested change

iptables_module="nf_tables"

if [ -n "$(echo $iptables_version | grep "legacy" 2> /dev/null)" ]; then

iptables_module="ip_tables"

fi

case $iptables_version in

*legacy*) iptables_module="ip_tables" ;;

*) iptables_module="nf_tables" ;;

esac

Done - thank you.

Un-done - now it's option 2!

Thanks! Yes, I wrote one, then wrote the other comment, it was possibly a bit confusing; we got there in the end ❤️

thaJeztah · 2025-04-03T10:01:00Z

contrib/dockerd-rootless-setuptool.sh

+	iptables_command=$(PATH=$PATH:/sbin:/usr/sbin command -v iptables 2> /dev/null) || :
+	iptables_version=""
+	if [ -n "$iptables_command" ]; then
+		iptables_version=$($iptables_command --version 2> /dev/null) || :


Actually; so iptables_version is only used to set iptables_module, correct? In that case, we could just put all here? Or won't that work?

Suggested change

iptables_command=$(PATH=$PATH:/sbin:/usr/sbin command -v iptables 2> /dev/null) || :

iptables_version=""

if [ -n "$iptables_command" ]; then

iptables_version=$($iptables_command --version 2> /dev/null) || :

# Many OSs now use iptables-nft by default so, check for module nf_tables by default. But,

# if "iptables --version" worked and reported "legacy", check for module ip_tables instead.

iptables_module="nf_tables"

iptables_command=$(PATH=$PATH:/sbin:/usr/sbin command -v iptables 2> /dev/null) || :

if [ -n "$iptables_command" ]; then

iptables_version=$($iptables_command --version 2> /dev/null) || :

case $iptables_version in

*legacy*) iptables_module="ip_tables" ;;

esac

The first block (instruction: iptables dependency check) is working out whether there's an iptables command, and the second block (instruction: ip_tables module dependency check) works out whether the kernel module is loaded.

So, I thought it was best for the second block to use the command the first block found - rather than finding the command again, but maybe a bit differently.

If that makes sense (?) ... I'll swap the grep for case, as you suggest above.

I've taken option 1 ... can update again if needed!

Sorry - misread, this is the first block ... done now.

CentOS 10 uses iptables-nft by default, and doesn't have kernel module ip_tables - so dockerd-rootless-setuptool.sh reports that the module is missing. It suggests installing it (which isn't needed), or using --skip-iptables (which disables iptables in daemon config). So, unless "iptables --version" command reports "legacy", check for kernel module "nf_tables" instead of "ip_tables". Signed-off-by: Rob Murray <[email protected]>

tianon

Seems fine to me 👍

thaJeztah

LGTM, thanks!

vvoland · 2025-04-17T17:16:24Z

contrib/dockerd-rootless-setuptool.sh

+	iptables_module="nf_tables"
+	iptables_command=$(PATH=$PATH:/sbin:/usr/sbin command -v iptables 2> /dev/null) || :
+	if [ -n "$iptables_command" ]; then
+		iptables_version=$($iptables_command --version 2> /dev/null) || :
+		case $iptables_version in
+			*legacy*) iptables_module="ip_tables" ;;
+		esac
 		faced_iptables_error=1


This sets faced_iptables_error=1 even when iptables are available

$ iptables --version iptables v1.8.10 (nf_tables)

$ curl https://get.docker.com/rootless | sh - [ERROR] Missing system requirements. Run the following commands to [ERROR] install the requirements and run this tool again. [ERROR] Alternatively iptables checks can be disabled with --skip-iptables .

robmry added area/contrib area/rootless Rootless Mode kind/bugfix PR's that fix bugs version/23.0 labels Apr 1, 2025

robmry added this to the 28.1.0 milestone Apr 1, 2025

robmry self-assigned this Apr 1, 2025

robmry added the impact/changelog label Apr 1, 2025

robmry changed the title ~~Rootlesskit: check for module nf_tables~~ Rootless setup: check for module nf_tables Apr 1, 2025

robmry force-pushed the rootlesskit_iptables_check branch 2 times, most recently from 08e52ac to 153c124 Compare April 2, 2025 09:02

robmry marked this pull request as ready for review April 2, 2025 10:01

robmry requested review from AkihiroSuda and tianon April 2, 2025 10:01

AkihiroSuda approved these changes Apr 2, 2025

View reviewed changes

AkihiroSuda added the process/cherry-pick/28.x label Apr 2, 2025

thaJeztah reviewed Apr 3, 2025

View reviewed changes

robmry force-pushed the rootlesskit_iptables_check branch from 153c124 to ad177b4 Compare April 3, 2025 18:27

robmry requested a review from thaJeztah April 3, 2025 18:28

robmry force-pushed the rootlesskit_iptables_check branch from ad177b4 to f80feba Compare April 3, 2025 19:25

tianon approved these changes Apr 3, 2025

View reviewed changes

thaJeztah approved these changes Apr 3, 2025

View reviewed changes

thaJeztah added status/4-merge and removed version/23.0 labels Apr 3, 2025

thaJeztah merged commit 4ad6854 into moby:master Apr 3, 2025
154 checks passed

vvoland reviewed Apr 17, 2025

View reviewed changes

This was referenced Apr 17, 2025

rootless: revert 28.1.0 from stable docker/docker-install#487

Merged

contrib/rootless-setuptool: Fix iptables detection #49833

Merged

robmry deleted the rootlesskit_iptables_check branch May 29, 2025 18:52

Conversation

robmry commented Apr 1, 2025 • edited by vvoland Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tianon left a comment

Choose a reason for hiding this comment

Uh oh!

thaJeztah left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

robmry commented Apr 1, 2025 •

edited by vvoland

Loading