docker fragment missing conntrack and netfilter entries? #meta-virtualization


Benjamin Mordaunt
 

Hi,

I have just completed a bringup of Poky on the ODROID N2+ platform, but noticed that Docker failed to start, complaining that it could not load the "nf_conntrack_netlink" module.
After checking docker.cfg, I noticed that a few configuration options I expected were missing.

Shouldn't the following be added: (?)

CONFIG_NETFILTER_NETLINK=m
CONFIG_NT_CT_NETLINK=m

CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m

Thanks,
Ben


Khem Raj
 

On 10/14/21 9:23 AM, crawford.benjamin15@gmail.com wrote:
Hi,
I have just completed a bringup of Poky on the ODROID N2+ platform, but noticed that Docker failed to start, complaining that it could not load the "nf_conntrack_netlink" module.
After checking docker.cfg, I noticed that a few configuration options I expected were missing.
Shouldn't the following be added: (?)
|CONFIG_NETFILTER_NETLINK=m|
|CONFIG_NT_CT_NETLINK=m|
|CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
seems fine. Please send a patch for enhancing it via docker.cfg

Thanks,
Ben|


Bruce Ashfield
 

On Thu, Oct 14, 2021 at 12:23 PM <crawford.benjamin15@gmail.com> wrote:

Hi,

I have just completed a bringup of Poky on the ODROID N2+ platform, but noticed that Docker failed to start, complaining that it could not load the "nf_conntrack_netlink" module.
After checking docker.cfg, I noticed that a few configuration options I expected were missing.

Shouldn't the following be added: (?)

CONFIG_NETFILTER_NETLINK=m
CONFIG_NT_CT_NETLINK=m

CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
FYI: you want the meta-virtualization mailing list, not the main yocto
one for questions like this.

There's a balancing act with the fragments: they are as
non-overlapping as possible, they often support a wide range of kernel
versions and kernel providers, so there are sometimes more, or less
options than you'd expect in a fragment.

In particular the fragments in meta-virtualization are changing right
now, and are being unified in the kernel-cache repository (that allows
the duplicated options to be rationalized).

So depending on which docker.cfg you are looking at, you'd either send
a patch to the linux-yocto mailing list, or the meta-virtualization
list.

In particular, the netfilter fragment is what is expected to provide
many of the needed options, and that's what has been happening with
the out of box docker, lxc, podman, k8s, etc, configurations tested in
meta-virt. The docker.scc fragment will start pulling that in
automatically as part of the de-duplication effort I hinted at above.

But there's no harm in sending a patch, I'll figure out how/where it
applies as I go through those efforts.

Cheers,

Bruce







Thanks,
Ben




--
- Thou shalt not follow the NULL pointer, for chaos and madness await
thee at its end
- "Use the force Harry" - Gandalf, Star Trek II