CNI bridge firewall: avoid using iptables backend on rootless mode

[AkihiroSuda]

See:

• nerdctl run - failed to add the address (failed to add the address 10.4.0.17/32 to trusted zone: Not Authorized(uid): org.fedoraproject.FirewallD1.config) containerd/nerdctl#2818

Similar to:

• [cherry-picked to v1.7.4] rootless: fix Not Authorized(uid): org.fedoraproject.FirewallD1.config containerd/nerdctl#2819

[tonistiigi]

What's the behavior difference of this? If this works always then we could just use this and skip adding firewall binary to the exported image.

[AkihiroSuda]

What's the behavior difference of this?

The iptables backend directly execs iptables binary (which works fine inside the user namespace).

The firewalld backend (default, when firewalld is detected) talks to the firewalld daemon. This fails for rootless:

• nerdctl run - failed to add the address (failed to add the address 10.4.0.17/32 to trusted zone: Not Authorized(uid): org.fedoraproject.FirewallD1.config) containerd/nerdctl#2818

If this works always then we could just use this and skip adding firewall binary to the exported image.

No, this is the configuration for the firewall plugin