docker异常unable to add return rule in DOCKER-ISOLATION-STAGE-1 chain

发布时间 2023-11-14 09:30:31作者: dearjazz

docker 重装启动异常

 

INFO[2021-03-09T15:06:20.839195000+08:00] Loading containers: start.
INFO[2021-03-09T15:06:20.885624800+08:00] stopping event stream following graceful shutdown  error="<nil>" module=libcontainerd namespace=moby
INFO[2021-03-09T15:06:20.885865900+08:00] stopping healthcheck following graceful shutdown  module=libcontainerd
INFO[2021-03-09T15:06:20.886012400+08:00] stopping event stream following graceful shutdown  error="context canceled" module=libcontainerd namespace=plugins.moby
failed to start daemon: Error initializing network controller: error obtaining controller instance: unable to add return rule in DOCKER-ISOLATION-STAGE-1 chain:  (iptables failed: iptables --wait -A DOCKER-ISOLATION-STAGE-1 -j RETURN: iptables v1.8.7 (nf_tables):  RULE_APPEND failed (No such file or directory): rule in chain DOCKER-ISOLATION-STAGE-1
 (exit status 4))

 

看到老外遇到相同问题这么解释的:

I noticed iptables being used is a nftables version. Turns out, Starting from version 20.10, Ubuntu switched the firewall system to nftables in like mentoned here; But unfortunately, using nftables natively requires Linux Kernel 5.8, where the latest Kernel version for WSL is 5.4.

Fortunately, Ubuntu still have a legacy version of iptables kept in the system. To do it, you can simlpy use update-alternatives --config iptables to change it:

 

解决方法:

$ sudo update-alternatives --config iptables
There are 2 choices for the alternative iptables (providing /usr/sbin/iptables).

Selection Path Priority Status
------------------------------------------------------------
* 0 /usr/sbin/iptables-nft 20 auto mode
1 /usr/sbin/iptables-legacy 10 manual mode
2 /usr/sbin/iptables-nft 20 manual mode

Press <enter> to keep the current choice[*], or type selection number: 1
update-alternatives: using /usr/sbin/iptables-legacy to provide /usr/sbin/iptables (iptables) in manual mode

最后docker服务重启
systemct restart docker