solve Failed to program NAT chain: failed to inject DOCKER in PREROUTING chain: iptables failed: iptables --wait -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER: Warning: Extension addrtype revision 0 not supported, missing kernel modul

Question

solve Failed to program NAT chain: failed to inject DOCKER in PREROUTING chain: iptables failed: iptables --wait -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER: Warning: Extension addrtype revision 0 not supported, missing kernel modul

Closed this issue 6 months ago · 8 comments

Hi,

I have succesfully upgraded to Linux nas542 6.1.79+nas5xx version

Solved previous issue, but another one emerged.

Failed to program NAT chain: failed to inject DOCKER in PREROUTING chain: iptables failed: iptables --wait -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER: Warning: Extension addrtype revision 0 not supported, missing kernel module?

Any hints?

Adam

Answer 1 · 2024-03-04T21:59:02.000Z

is it possible that this is missing:
https://www.kernelconfig.io/config_netfilter_xt_match_addrtype

I will try to build with this flag

Answer 2 · 2024-03-05T18:31:55.000Z

Just in case I have added few more and VOILA:

CONFIG_NETFILTER_XT_MATCH_POLICY=m
CONFIG_NETFILTER_XT_MATCH_REALM=m
CONFIG_NETFILTER_XT_MATCH_SCTP=m
CONFIG_NETFILTER_XT_MATCH_STATE=m
CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
CONFIG_NETFILTER_XT_MATCH_STRING=m
CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
CONFIG_NETFILTER_XT_MATCH_TIME=m
CONFIG_NETFILTER_XT_MATCH_U32=m
CONFIG_NETFILTER_XT_MATCH_UDP=m
CONFIG_NETFILTER_XT_MATCH_ULOG=m
CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
CONFIG_NETFILTER_XT_MATCH_AH=m
CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
CONFIG_NETFILTER_XT_MATCH_COMMENT=m
CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
CONFIG_NETFILTER_XT_MATCH_CPU=m
CONFIG_NETFILTER_XT_MATCH_DCCP=m
CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m
CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ECN=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_HL=m
CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
CONFIG_NETFILTER_XT_MATCH_IPVS=m
CONFIG_NETFILTER_XT_MATCH_L2TP=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
CONFIG_NETFILTER_XT_MATCH_LIMIT=m
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
CONFIG_NETFILTER_XT_MATCH_NFACCT=m
CONFIG_NETFILTER_XT_MATCH_OSF=m
CONFIG_NETFILTER_XT_MATCH_OWNER=m
CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
CONFIG_NETFILTER_XT_MATCH_QUOTA=m
CONFIG_NETFILTER_XT_MATCH_RATEEST=m
CONFIG_NETFILTER_XT_MATCH_REALM=m
CONFIG_NETFILTER_XT_MATCH_RECENT=m
CONFIG_NETFILTER_XT_MATCH_SCTP=m
CONFIG_NETFILTER_XT_MATCH_SOCKET=m

Answer 3 · 2024-03-06T10:03:35.000Z

According to https://github.com/moby/moby/blob/master/contrib/check-config.sh there is some more bits and pieces that would be nice to have in the kernel in order to get the full docker experience.

Answer 4 · 2024-03-06T10:21:59.000Z

You mean like this ones:
BLK_CGROUP BLK_DEV_THROTTLING
CGROUP_PERF
CGROUP_HUGETLB
NET_CLS_CGROUP $netprio
CFS_BANDWIDTH FAIR_GROUP_SCHED
IP_NF_TARGET_REDIRECT
IP_VS
IP_VS_NFCT
IP_VS_PROTO_TCP
IP_VS_PROTO_UDP
IP_VS_RR
SECURITY_SELINUX
SECURITY_APPARMOR
?

Answer 5 · 2024-03-06T11:00:24.000Z

Partially, yes 👍

I'm currently running Linux nas542 6.6.14+nas5xx #nas5xx SMP Sun Feb 25 00:08:24 UTC 2024 armv7l GNU/Linux (https://seafile.servator.de/nas/zyxel/kernel/linux-image-6.6.14-20240220-nas5xx-armhf.zip) and the check returns following results

nas542:~# bash check-config.sh
info: reading kernel config from /proc/config.gz ...

Generally Necessary:
- cgroup hierarchy: cgroupv2
  Controllers:
  - cpu: available
  - cpuset: available
  - io: missing
  - memory: missing
  - pids: missing
- CONFIG_NAMESPACES: enabled
- CONFIG_NET_NS: enabled
- CONFIG_PID_NS: enabled
- CONFIG_IPC_NS: enabled
- CONFIG_UTS_NS: enabled
- CONFIG_CGROUPS: enabled
- CONFIG_CGROUP_CPUACCT: enabled
- CONFIG_CGROUP_DEVICE: enabled
- CONFIG_CGROUP_FREEZER: missing
- CONFIG_CGROUP_SCHED: enabled
- CONFIG_CPUSETS: enabled
- CONFIG_MEMCG: missing
- CONFIG_KEYS: enabled
- CONFIG_VETH: enabled (as module)
- CONFIG_BRIDGE: enabled (as module)
- CONFIG_BRIDGE_NETFILTER: enabled (as module)
- CONFIG_IP_NF_FILTER: enabled (as module)
- CONFIG_IP_NF_MANGLE: enabled (as module)
- CONFIG_IP_NF_TARGET_MASQUERADE: enabled (as module)
- CONFIG_NETFILTER_XT_MATCH_ADDRTYPE: missing
- CONFIG_NETFILTER_XT_MATCH_CONNTRACK: enabled (as module)
- CONFIG_NETFILTER_XT_MATCH_IPVS: missing
- CONFIG_NETFILTER_XT_MARK: missing
- CONFIG_IP_NF_NAT: enabled (as module)
- CONFIG_NF_NAT: enabled (as module)
- CONFIG_POSIX_MQUEUE: missing
- CONFIG_CGROUP_BPF: missing

Optional Features:
- CONFIG_USER_NS: enabled
- CONFIG_SECCOMP: enabled
- CONFIG_SECCOMP_FILTER: enabled
- CONFIG_CGROUP_PIDS: missing
- CONFIG_MEMCG_SWAP: missing
    (cgroup swap accounting is currently enabled)
- CONFIG_BLK_CGROUP: missing
- CONFIG_BLK_DEV_THROTTLING: missing
- CONFIG_CGROUP_PERF: missing
- CONFIG_CGROUP_HUGETLB: missing
- CONFIG_NET_CLS_CGROUP: enabled (as module)
- CONFIG_CGROUP_NET_PRIO: missing
- CONFIG_CFS_BANDWIDTH: missing
- CONFIG_FAIR_GROUP_SCHED: enabled
- CONFIG_IP_NF_TARGET_REDIRECT: enabled (as module)
- CONFIG_IP_VS: missing
- CONFIG_IP_VS_NFCT: missing
- CONFIG_IP_VS_PROTO_TCP: missing
- CONFIG_IP_VS_PROTO_UDP: missing
- CONFIG_IP_VS_RR: missing
- CONFIG_SECURITY_SELINUX: missing
- CONFIG_SECURITY_APPARMOR: missing
- CONFIG_EXT3_FS: enabled (as module)
- CONFIG_EXT3_FS_XATTR: missing
- CONFIG_EXT3_FS_POSIX_ACL: enabled
- CONFIG_EXT3_FS_SECURITY: enabled
    (enable these ext3 configs if you are using ext3 as backing filesystem)
- CONFIG_EXT4_FS: enabled
- CONFIG_EXT4_FS_POSIX_ACL: enabled
- CONFIG_EXT4_FS_SECURITY: enabled
- Network Drivers:
  - "overlay":
    - CONFIG_VXLAN: missing
    - CONFIG_BRIDGE_VLAN_FILTERING: missing
      Optional (for encrypted networks):
      - CONFIG_CRYPTO: enabled
      - CONFIG_CRYPTO_AEAD: enabled
      - CONFIG_CRYPTO_GCM: enabled (as module)
      - CONFIG_CRYPTO_SEQIV: enabled (as module)
      - CONFIG_CRYPTO_GHASH: enabled (as module)
      - CONFIG_XFRM: enabled
      - CONFIG_XFRM_USER: enabled (as module)
      - CONFIG_XFRM_ALGO: enabled (as module)
      - CONFIG_INET_ESP: enabled (as module)
      - CONFIG_NETFILTER_XT_MATCH_BPF: missing
  - "ipvlan":
    - CONFIG_IPVLAN: missing
  - "macvlan":
    - CONFIG_MACVLAN: enabled (as module)
    - CONFIG_DUMMY: enabled (as module)
  - "ftp,tftp client in container":
    - CONFIG_NF_NAT_FTP: enabled (as module)
    - CONFIG_NF_CONNTRACK_FTP: enabled (as module)
    - CONFIG_NF_NAT_TFTP: missing
    - CONFIG_NF_CONNTRACK_TFTP: missing
- Storage Drivers:
  - "btrfs":
    - CONFIG_BTRFS_FS: enabled (as module)
    - CONFIG_BTRFS_FS_POSIX_ACL: enabled
  - "overlay":
    - CONFIG_OVERLAY_FS: missing
  - "zfs":
    - /dev/zfs: missing
    - zfs command: missing
    - zpool command: missing

Limits:
- /proc/sys/kernel/keys/root_maxkeys: 1000000

Answer 6 · 2024-03-06T11:30:53.000Z

ls1024a_defconfig_missing_docker.txt
Here you are. I will try compile 6.1 and 6.6 branch and post result

Answer 7 · 2024-03-06T14:44:41.000Z

I got issue on missing rsync dependency,
apt install rsync solved the problem and I was able to continue build :-)

Answer 8 · 2024-03-06T15:14:04.000Z

linux-image-6.6.14-20240225-nas5xx-armhf.zip
6.6.14 is working :-)
but not all was corrected:
root@nas542:/home/admin/kernel6.6.14_full# bash -e check-config.sh
info: reading kernel config from /proc/config.gz ...

Generally Necessary:

cgroup hierarchy: cgroupv2
Controllers:
- cpu: available
- cpuset: available
- io: missing
- memory: missing
- pids: missing
CONFIG_NAMESPACES: enabled
CONFIG_NET_NS: enabled
CONFIG_PID_NS: enabled
CONFIG_IPC_NS: enabled
CONFIG_UTS_NS: enabled
CONFIG_CGROUPS: enabled
CONFIG_CGROUP_CPUACCT: enabled
CONFIG_CGROUP_DEVICE: enabled
CONFIG_CGROUP_FREEZER: missing
CONFIG_CGROUP_SCHED: enabled
CONFIG_CPUSETS: enabled
CONFIG_MEMCG: missing
CONFIG_KEYS: enabled
CONFIG_VETH: enabled (as module)
CONFIG_BRIDGE: enabled (as module)
CONFIG_BRIDGE_NETFILTER: enabled (as module)
CONFIG_IP_NF_FILTER: enabled (as module)
CONFIG_IP_NF_MANGLE: enabled (as module)
CONFIG_IP_NF_TARGET_MASQUERADE: enabled (as module)
CONFIG_NETFILTER_XT_MATCH_ADDRTYPE: enabled (as module)
CONFIG_NETFILTER_XT_MATCH_CONNTRACK: enabled (as module)
CONFIG_NETFILTER_XT_MATCH_IPVS: enabled (as module)
CONFIG_NETFILTER_XT_MARK: enabled (as module)
CONFIG_IP_NF_NAT: enabled (as module)
CONFIG_NF_NAT: enabled (as module)
CONFIG_POSIX_MQUEUE: missing
CONFIG_CGROUP_BPF: missing

Optional Features:

CONFIG_USER_NS: enabled
CONFIG_SECCOMP: enabled
CONFIG_SECCOMP_FILTER: enabled
CONFIG_CGROUP_PIDS: missing
CONFIG_MEMCG_SWAP: missing
(cgroup swap accounting is currently enabled)
CONFIG_BLK_CGROUP: missing
CONFIG_BLK_DEV_THROTTLING: missing
CONFIG_CGROUP_PERF: missing
CONFIG_CGROUP_HUGETLB: missing
CONFIG_NET_CLS_CGROUP: enabled (as module)
CONFIG_CGROUP_NET_PRIO: missing
CONFIG_CFS_BANDWIDTH: missing
CONFIG_FAIR_GROUP_SCHED: enabled
CONFIG_IP_NF_TARGET_REDIRECT: enabled (as module)
CONFIG_IP_VS: enabled (as module)
CONFIG_IP_VS_NFCT: missing
CONFIG_IP_VS_PROTO_TCP: missing
CONFIG_IP_VS_PROTO_UDP: missing
CONFIG_IP_VS_RR: enabled (as module)
CONFIG_SECURITY_SELINUX: missing
CONFIG_SECURITY_APPARMOR: missing
CONFIG_EXT3_FS: enabled (as module)
CONFIG_EXT3_FS_XATTR: missing
CONFIG_EXT3_FS_POSIX_ACL: enabled
CONFIG_EXT3_FS_SECURITY: enabled
(enable these ext3 configs if you are using ext3 as backing filesystem)
CONFIG_EXT4_FS: enabled
CONFIG_EXT4_FS_POSIX_ACL: enabled
CONFIG_EXT4_FS_SECURITY: enabled
Network Drivers:
- "overlay":
  - CONFIG_VXLAN: missing
  - CONFIG_BRIDGE_VLAN_FILTERING: missing
    Optional (for encrypted networks):
    - CONFIG_CRYPTO: enabled
    - CONFIG_CRYPTO_AEAD: enabled
    - CONFIG_CRYPTO_GCM: enabled (as module)
    - CONFIG_CRYPTO_SEQIV: enabled (as module)
    - CONFIG_CRYPTO_GHASH: enabled (as module)
    - CONFIG_XFRM: enabled
    - CONFIG_XFRM_USER: enabled (as module)
    - CONFIG_XFRM_ALGO: enabled (as module)
    - CONFIG_INET_ESP: enabled (as module)
    - CONFIG_NETFILTER_XT_MATCH_BPF: enabled (as module)
- "ipvlan":
  - CONFIG_IPVLAN: enabled (as module)
- "macvlan":
  - CONFIG_MACVLAN: enabled (as module)
  - CONFIG_DUMMY: enabled (as module)
- "ftp,tftp client in container":
  - CONFIG_NF_NAT_FTP: enabled (as module)
  - CONFIG_NF_CONNTRACK_FTP: enabled (as module)
  - CONFIG_NF_NAT_TFTP: enabled (as module)
  - CONFIG_NF_CONNTRACK_TFTP: enabled (as module)
Storage Drivers:
- "btrfs":
  - CONFIG_BTRFS_FS: enabled (as module)
  - CONFIG_BTRFS_FS_POSIX_ACL: enabled
- "overlay":
  - CONFIG_OVERLAY_FS: enabled (as module)
- "zfs":
  - /dev/zfs: missing
  - zfs command: missing
  - zpool command: missing

Limits:

/proc/sys/kernel/keys/root_maxkeys: 1000000