Environment:
- OS: AlmaLinux 10.2
- Docker version: Docker version 29.6.2, build dfc4efb
- iptables: iptables-nft-1.8.11-15.el10_2.x86_64
Description:
dockerd fails to start with:
failed to start daemon: Error initializing network controller: error obtaining controller instance: failed to register "bridge" driver: failed to add jump rules to ipv4 NAT table: failed to append jump rules to nat-PREROUTING: (COMMAND_FAILED: '/usr/sbin/iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER' failed: Warning:
Extension addrtype revision 0 not supported, missing kernel module?
Root cause:
The addrtype match requires the xt_addrtype kernel module, provided by the kernel-modules-extra package on RHEL-family distros. Until recently, kernel-modules-extra was pulled in automatically as an unconditional Recommends of iptables-nft, so it was present on any system with Docker installed, even though docker-ce itself never declared it as a dependency.
That changed upstream in iptables 1.8.11-15.el10:
- spec: Recommend kernel-modules-extra only if no other
recommendation applies (Phil Sutter) [RHEL-186232]
Resolves: RHEL-186232
Source: https://git.almalinux.org/rpms/iptables/commit/bdfc71a038368010b31ac9ceb282ba4b23323455
With this change, kernel-modules-extra is no longer reliably installed as a side effect of installing iptables-nft. Since docker-ce.spec does not list kernel-modules-extra as a Requires or Recommends itself, fresh installs of Docker on updated RHEL 10 / AlmaLinux 10 / Rocky 10 systems can now fail to start with the error above, depending on the exact iptables package version and what else is installed on the host.
Requested fix:
Add an explicit Requires (or at minimum Recommends) on kernel-modules-extra in rpm/SPECS/docker-ce.spec for RHEL-family targets (rhel-9, rhel-10, centos-9, centos-10), since dockerd's default bridge network setup depends on the addrtype match and can no longer assume it will be pulled in transitively via iptables.
Workaround in the meantime:
dnf install kernel-modules-extra
systemctl restart docker.service
Environment:
Description:
dockerd fails to start with:
failed to start daemon: Error initializing network controller: error obtaining controller instance: failed to register "bridge" driver: failed to add jump rules to ipv4 NAT table: failed to append jump rules to nat-PREROUTING: (COMMAND_FAILED: '/usr/sbin/iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER' failed: Warning:
Extension addrtype revision 0 not supported, missing kernel module?
Root cause:
The addrtype match requires the xt_addrtype kernel module, provided by the kernel-modules-extra package on RHEL-family distros. Until recently, kernel-modules-extra was pulled in automatically as an unconditional Recommends of iptables-nft, so it was present on any system with Docker installed, even though docker-ce itself never declared it as a dependency.
That changed upstream in iptables 1.8.11-15.el10:
recommendation applies (Phil Sutter) [RHEL-186232]
Resolves: RHEL-186232
Source: https://git.almalinux.org/rpms/iptables/commit/bdfc71a038368010b31ac9ceb282ba4b23323455
With this change, kernel-modules-extra is no longer reliably installed as a side effect of installing iptables-nft. Since docker-ce.spec does not list kernel-modules-extra as a Requires or Recommends itself, fresh installs of Docker on updated RHEL 10 / AlmaLinux 10 / Rocky 10 systems can now fail to start with the error above, depending on the exact iptables package version and what else is installed on the host.
Requested fix:
Add an explicit Requires (or at minimum Recommends) on kernel-modules-extra in rpm/SPECS/docker-ce.spec for RHEL-family targets (rhel-9, rhel-10, centos-9, centos-10), since dockerd's default bridge network setup depends on the addrtype match and can no longer assume it will be pulled in transitively via iptables.
Workaround in the meantime:
dnf install kernel-modules-extra
systemctl restart docker.service