- Notifications
You must be signed in to change notification settings - Fork18.8k
Rootless setup: check for module nf_tables#49727
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
08e52ac to153c124Compare| iptables_module="nf_tables" | ||
| if [ -n "$(echo $iptables_version | grep "legacy" 2> /dev/null)" ]; then | ||
| iptables_module="ip_tables" | ||
| fi |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Probably don't need to grep here if we use a switch;
| iptables_module="nf_tables" | |
| if [-n"$(echo$iptables_version| grep"legacy"2> /dev/null)" ];then | |
| iptables_module="ip_tables" | |
| fi | |
| case$iptables_versionin | |
| *legacy*) iptables_module="ip_tables";; | |
| *)iptables_module="nf_tables";; | |
| esac |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Done - thank you.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Un-done - now it's option 2!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Thanks! Yes, I wrote one, then wrote the other comment, it was possibly a bit confusing; we got there in the end ❤️
| iptables_command=$(PATH=$PATH:/sbin:/usr/sbin command -v iptables 2> /dev/null) || : | ||
| iptables_version="" | ||
| if [ -n "$iptables_command" ]; then | ||
| iptables_version=$($iptables_command --version 2> /dev/null) || : |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Actually; soiptables_version is only used to setiptables_module, correct? In that case, we could just put all here? Or won't that work?
| iptables_command=$(PATH=$PATH:/sbin:/usr/sbincommand -v iptables2> /dev/null)||: | |
| iptables_version="" | |
| if [-n"$iptables_command" ];then | |
| iptables_version=$($iptables_command --version2> /dev/null)||: | |
| # Many OSs now use iptables-nft by default so, check for module nf_tables by default. But, | |
| # if "iptables --version" worked and reported "legacy", check for module ip_tables instead. | |
| iptables_module="nf_tables" | |
| iptables_command=$(PATH=$PATH:/sbin:/usr/sbincommand -v iptables2> /dev/null)||: | |
| if [-n"$iptables_command" ];then | |
| iptables_version=$($iptables_command --version2> /dev/null)||: | |
| case$iptables_versionin | |
| *legacy*) iptables_module="ip_tables";; | |
| esac |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
The first block (instruction: iptables dependency check) is working out whether there's aniptables command, and the second block (instruction: ip_tables module dependency check) works out whether the kernel module is loaded.
So, I thought it was best for the second block to use the command the first block found - rather than finding the command again, but maybe a bit differently.
If that makes sense (?) ... I'll swap the grep for case, as you suggest above.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
I've taken option 1 ... can update again if needed!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Sorry - misread, this is the first block ... done now.
153c124 toad177b4CompareCentOS 10 uses iptables-nft by default, and doesn't havekernel module ip_tables - so dockerd-rootless-setuptool.shreports that the module is missing. It suggests installingit (which isn't needed), or using --skip-iptables (whichdisables iptables in daemon config).So, unless "iptables --version" command reports "legacy",check for kernel module "nf_tables" instead of "ip_tables".Signed-off-by: Rob Murray <rob.murray@docker.com>
ad177b4 tof80febaCompareThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Seems fine to me 👍
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
LGTM, thanks!
4ad6854 intomoby:masterUh oh!
There was an error while loading.Please reload this page.
| iptables_module="nf_tables" | ||
| iptables_command=$(PATH=$PATH:/sbin:/usr/sbin command -v iptables 2> /dev/null) || : | ||
| if [ -n "$iptables_command" ]; then | ||
| iptables_version=$($iptables_command --version 2> /dev/null) || : | ||
| case $iptables_version in | ||
| *legacy*) iptables_module="ip_tables" ;; | ||
| esac | ||
| faced_iptables_error=1 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
This setsfaced_iptables_error=1 even when iptables are available
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
$ iptables --versioniptables v1.8.10 (nf_tables)$ curl https://get.docker.com/rootless | sh -[ERROR] Missing system requirements. Run the following commands to[ERROR] install the requirements and run this tool again.[ERROR] Alternatively iptables checks can be disabled with --skip-iptables .There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
cc@robmry
Uh oh!
There was an error while loading.Please reload this page.
- What I did
CentOS 10 uses
iptables-nftby default, and doesn't have kernel module ip_tables - sodockerd-rootless-setuptool.shreports that the module is missing. It suggests installing it (which isn't needed), or using--skip-iptables(which disables iptables in daemon config).- How I did it
Unless the
iptables --versioncommand reportslegacy, check for kernel modulenf_tablesinstead ofip_tables.- How to verify it
Ran the install script on a CentOS Stream 10 VM, it worked normally with these changes.
(Not tested on RHEL10 as I don't have a license.)
On a Debian host, where I could switch between
iptables-nftandiptables-legacy- with kernel moduleip_tablesunloaded ("rlk_setup.sh" was my modified version of the script) ...Switched to iptables-nft, with
ip_tablesstill not loaded, then ...- Human readable description for the release notes