Also load `ip6_tables` when trying to load `ip_tables`

docker-library / docker

Docker Official Image packaging for Docker

Apache License 2.0

1.09k stars 568 forks source link

Also load `ip6_tables` when trying to load `ip_tables` #501

Closed tianon closed 2 weeks ago

tianon commented 2 weeks ago

This isn't used/necessary in the default configuration until Docker 27+, but it was optional behavior before that, so it's prudent for us to also try loading it any time we know we're not using nftables / have explicitly requested "legacy" iptables.

See also:

https://github.com/moby/moby/pull/47747
https://github.com/moby/moby/issues/47895
https://github.com/moby/moby/pull/47918
https://github.com/moby/moby/pull/47960

cc/fyi @robmry @akerouanton :heart:

tianon commented 2 weeks ago

I thought we'd already been doing this, but apparently I was misremembering, probably because we do check the /proc/net/ip6_tables_names file for clues to whether we should be using legacy xtables. :sweat_smile: