Re: Docker 20.10.3 breaks due to iptables v1.8.7 (legacy) incompatibility #meta-virtualization


Stephen
 

Thanks for the reply Bruce __ Let me know if these details help?

root@generic-arm64:~# uname -r
5.10.46-yocto-standard

Only setting these two kernel configs at the moment:
CONFIG_ENA_ETHERNET=y
CONFIG_BLK_DEV_NVME=y

And these are the layers, running harknott...
drwxrwxr-x 12 ubuntu ubuntu 4096 Sep 29 14:02 meta-arm/
drwxrwxr-x 8 ubuntu ubuntu 4096 Sep 29 14:00 meta-ewaol/
drwxrwxr-x 11 ubuntu ubuntu 4096 Sep 29 15:09 meta-openembedded/
drwxrwxr-x 24 ubuntu ubuntu 4096 Sep 29 14:02 meta-security/
drwxrwxr-x 17 ubuntu ubuntu 4096 Sep 29 14:02 meta-virtualization/


´╗┐On 30/09/2021, 16:32, "Bruce Ashfield" <bruce.ashfield@...> wrote:

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.



On Thu, Sep 30, 2021 at 10:41 AM Stephen via lists.yoctoproject.org
<stephibb=amazon.co.uk@...> wrote:
>
> Hello all!
>
> The current meta-virtualisation docker is incompatible with the legacy v1.8.7 iptables.
>
> Docker version 20.10.3, build 41b3ea7e47 http://layers.openembedded.org/layerindex/recipe/176817/
>
> iptables v1.8.7 (legacy) https://git.yoctoproject.org/cgit.cgi/poky/plain/meta/recipes-extended/iptables/
>
> level=info time=2021-09-30T08:58:56Z msg="TaskHandler: Sending task change: TaskChange: [arn:aws:ecs:eu-west-1:116589935960:task/GravitonID-ecs-ECSGra viton2DA545608-tzdG3bupgLcn/ef8d9ea15a434c298a9623551d39c6ab -> STOPPED, Known Sent: NONE, PullStartedAt: 2021-09-30 08:58:55.809460935 +0000 UTC m=+5 2315.765706001, PullStoppedAt: 2021-09-30 08:58:55.919351717 +0000 UTC m=+52315.875596782, ExecutionStoppedAt: 2021-09-30 08:58:56.159356552 +0000 UTC m=+52316.115601617, container change: arn:aws:ecs:eu-west-1:116589935960:task/GravitonID-ecs-ECSGraviton2DA545608-tzdG3bupgLcn/ef8d9ea15a434c298a9623 551d39c6ab web -> STOPPED, Reason CannotStartContainerError: Error response from daemon: driver failed programming external connectivity on endpoint e cs-GravitonIDecsTaskDefA2CA7A76-4-web-9eb9aba094eccadb1300 (db13dc1931d5be70284cac4de6899246035db8e5f9e0cf9ee3773000801a70b0): (iptables failed: ipta bles --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 8080 -j DNAT --to-destination 172.17.0.2:3000 ! -i docker0: iptables v1.8.7 (legacy): unknown optio n \"--to-destination\"\nTry `iptables -h' or 'iptables --help' for more information.\n (exit status 2)), Known Sent: NONE] sent: false" module=task_ha ndler_types.go
>
> Possibly linked to this issue and nftables support? https://github.com/moby/moby/issues/38099
>
> Any ideas for workarounds would be very much appreciated!

It's your kernel configuration, coupled with the iptables modules
available .. but most often, it is a missing kernel module.

So without knowing exactly what kernel and hardware you are running,
it is hard to say more.

Bruce

>
>
>
>


--
- Thou shalt not follow the NULL pointer, for chaos and madness await
thee at its end
- "Use the force Harry" - Gandalf, Star Trek II




Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, R.C.S. Luxembourg B186284

Amazon Web Services EMEA Sarl, UK Branch, 1 Principal Place, Worship Street, London, EC2A 2FA, United Kingdom, registered in England and Wales, UK Establishment No. BR019315

Join meta-virtualization@lists.yoctoproject.org to automatically receive all group messages.