Add DOCKER_IPTABLES_LEGACY for letting users explicitly pick `iptab…

…les-legacy` via `--env DOCKER_IPTABLES_LEGACY=1`
docker-library · Jan 4, 2024 · eb4c40e · eb4c40e
1 parent d5d05eb
commit eb4c40e
Show file tree

Hide file tree

Showing 3 changed files with 30 additions and 3 deletions.
diff --git a/24/dind/dockerd-entrypoint.sh b/24/dind/dockerd-entrypoint.sh
diff --git a/25-rc/dind/dockerd-entrypoint.sh b/25-rc/dind/dockerd-entrypoint.sh
diff --git a/dockerd-entrypoint.sh b/dockerd-entrypoint.sh
@@ -144,7 +144,15 @@ if [ "$1" = 'dockerd' ]; then
  set -- docker-init -- "$@"
 
  iptablesLegacy=
- if (
+ if [ -n "${DOCKER_IPTABLES_LEGACY+x}" ]; then
+ # let users choose explicitly to legacy or not to legacy
+ iptablesLegacy="$DOCKER_IPTABLES_LEGACY"
+ if [ -n "$iptablesLegacy" ]; then
+ modprobe ip_tables || :
+ else
+ modprobe nf_tables || :
+ fi
+ elif (
  # https://git.netfilter.org/iptables/tree/iptables/nft-shared.c?id=f5cf76626d95d2c491a80288bccc160c53b44e88#n420
  # https:/docker-library/docker/pull/468#discussion_r1442131459
  for f in /proc/net/ip_tables_names /proc/net/ip6_tables_names /proc/net/arp_tables_names; do
@@ -174,6 +182,7 @@ if [ "$1" = 'dockerd' ]; then
  # see https:/docker-library/docker/issues/463 (and the dind Dockerfile where this directory is set up)
  export PATH="/usr/local/sbin/.iptables-legacy:$PATH"
  fi
+ iptables --version # so users can see whether it's legacy or not
 
  uid="$(id -u)"
  if [ "$uid" != '0' ]; then