[docker-in-docker] Not working on fedora kernel > 6.11.7-300.fc41.x86_64

[michalholis]

Feature https://github.com/devcontainers/features/tree/main/src/docker-in-docker for some reason doesn't work for us on Fedora 41 on kernel versions 6.11.7-300.fc41.x86_64. Kernel 6.11.7-300.fc41.x86_64 is the last one working without issues. On any newer kernel any docker command returns Cannot connect to the Docker daemon at unix:/var/run/docker.sock. Is the docker daemon running?.

Communication fails on any docker command and fails even on clean Fedora installation.

[Kaniska244]

Hello @michalholis ,

Thank you for reporting the issue. I will check and get back on this.

With Regards,
Kaniska

[David-337]

Same issue here on Bluefin which is a distro based on Fedora

[HerrNaN]

Any updates on this?

[matus-sabo]

Some information and workaround (debian bookworm docker image)

sudo dockerd --debug

failed to start daemon: Error initializing network controller: 
error obtaining controller instance: failed to register "bridge" driver: 
failed to create NAT chain DOCKER: iptables failed: iptables -t nat -N DOCKER: 
modprobe: FATAL: Module ip_tables not found in directory /lib/modules/6.12.11-200.fc41.x86_64
iptables v1.8.9 (legacy): can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
 (exit status 3)

Problem is that your host system do not load ip_tables kernel module.
If lsmod | grep ip_tables is empty you need load ip_tables kernel module.

To load ip_tables kernel module you can run

sudo modprobe ip_tables

Pernament solution that survive reboots ( I am using Fedora silverblue )
/etc/modules-load.d/ip_tables.conf

ip_tables

docker info finally working 🚀

[spietras]

I suspect this might happen if you don't have the ip_tables module loaded, which is required for iptables-legacy to work. Most likely you only have nf_tables module, which should be fine, if you can use iptables-nft.

If I do this inside the container (using ubuntu as base):

sudo update-alternatives --set iptables /usr/sbin/iptables-nft
sudo dockerd

then it doesn't fail.

However, I can see that docker-in-docker install script first installs iptables package (which for me always provides both iptables-legacy and iptables-nft) and then links iptables command to iptables-legacy if iptables-legacy is present. Which results in iptables-legacy always being used and always failing if you don't have ip_tables module.

features/src/docker-in-docker/install.sh

Lines 218 to 222 in 5c67da0

	# Swap to legacy iptables for compatibility
	if type iptables-legacy > /dev/null 2>&1; then
	update-alternatives --set iptables /usr/sbin/iptables-legacy
	update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
	fi

I am not fully sure about that, but maybe the installation script should not link to iptables-legacy, but instead keep iptables linked to whatever it is linked by default (which is iptables-nft is my case).

[matus-sabo]

@spietras Yes you are right load ip_tables kernel module resolve this issue 👍