Skip to content

port/builtin: switch from iptables to nft for transparent routing - #613

Open
Akshitguptaa wants to merge 1 commit into
rootless-containers:masterfrom
Akshitguptaa:fix-589-nft
Open

port/builtin: switch from iptables to nft for transparent routing#613
Akshitguptaa wants to merge 1 commit into
rootless-containers:masterfrom
Akshitguptaa:fix-589-nft

Conversation

@Akshitguptaa

@Akshitguptaa Akshitguptaa commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Fixes #589

AkihiroSuda
AkihiroSuda reviewed Jul 23, 2026
View reviewed changes
Comment thread pkg/port/builtin/child/child.go

@AkihiroSuda AkihiroSuda Jul 23, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's keep iptables mode too and test the both in CI

@Akshitguptaa Akshitguptaa Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

kept iptables as a fallback.
CI runs test with both nft and iptables, and a separate one with only iptables (no nft) to cover the fallback path.

@Akshitguptaa
Akshitguptaa requested a review from AkihiroSuda July 24, 2026 10:32
AkihiroSuda
AkihiroSuda reviewed Jul 26, 2026
View reviewed changes
Comment thread pkg/port/builtin/child/child.go
@AkihiroSuda AkihiroSuda added this to the v3.1.0 milestone Jul 26, 2026
@Akshitguptaa
port/builtin: switch from iptables to nft for transparent routing
930bdfb 
Signed-off-by: akshitguptaa <akshitguptaa29@gmail.com>
AkihiroSuda
AkihiroSuda approved these changes Aug 4, 2026
View reviewed changes

@AkihiroSuda AkihiroSuda left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, looks good, but let me check this again by the end of the month

@Akshitguptaa

Akshitguptaa commented Aug 4, 2026

Copy link
Copy Markdown
Contributor Author

Thanks, looks good, but let me check this again by the end of the month

One thing worth a look before then: PortDriverInfo.Extra currently reports the configured --source-ip-transparent-backend, not the runtime-selected one. Backend selection happens lazily on the first transparent connection, so Extra can say "auto" while the child is actually running iptables (or hasn't decided anything yet).

Two ways to fix it:

  1. make routing setup eager (run at init, not lazily on first connection) - smaller diff, but changes existing behavior: firewall rules get installed at startup even if source-ip-transparent is never actually used

  2. keep it lazy, make Info() a live on-demand query to the child - bigger diff, no behavior change

Which do you prefer?

@AkihiroSuda

AkihiroSuda commented Aug 4, 2026

Copy link
Copy Markdown
Member

Thanks, 1 seems better

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@AkihiroSuda AkihiroSuda AkihiroSuda approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

v3.2.0

Development

Successfully merging this pull request may close these issues.

port/builtin: switch away from iptables to nft

2 participants

@Akshitguptaa @AkihiroSuda