Detect ip6tables failure without full ipv6 support

[afbjorklund]

Error when running with kernel from Kata Containers:

    can't initialize ip6tables table `filter':
    Table does not exist (do you need to insmod?)
    Perhaps ip6tables or your kernel needs to be upgraded.

This happens also in Apple Containers. Fallback to ipv4 only.
The alternative is building a custom kernel, with full support.

This fixes the kind create cluster error that was encountered in:

• Apple Containerization framework #3958 (comment)

---

Assuming that user has redirected from nft to legacy, that is.

update-alternatives --set iptables /usr/sbin/iptables-legacy
update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy

Got some other error, when trying to create with default iptables.

# docker network create -d=bridge -o com.docker.network.bridge.enable_ip_masquerade=true -o com.docker.network.driver.mtu=1500 kind
Error response from daemon: Failed to Setup IP tables: Unable to enable NAT rule:  (iptables failed: iptables --wait -t nat -I POSTROUTING -s 172.18.0.0/16 ! -o br-b505b0155599 -j MASQUERADE: Warning: Extension MASQUERADE revision 0 not supported, missing kernel module?
iptables v1.8.10 (nf_tables): Could not fetch rule set generation id: Invalid argument
 (exit status 4))

• Container 0.4.1
• Linux 6.12.28

https://github.com/apple/container/blob/main/docs/tutorial.md

https://github.com/kata-containers/kata-containers/releases/tag/3.17.0

• Ubuntu 24.04.3 LTS
• Docker 28.4.0 CE

---

Here is the regular Ubuntu kernel, for reference:

CONFIG_IP_NF_IPTABLES=m
CONFIG_IP6_NF_IPTABLES=m

CONFIG_NF_NAT_MASQUERADE=y
CONFIG_NETFILTER_XT_TARGET_MASQUERADE=m
CONFIG_IP_NF_TARGET_MASQUERADE=m
CONFIG_IP6_NF_TARGET_MASQUERADE=m

And here is the Kata Containers kernel, no IPv6:

# zgrep IPTABLES /proc/config.gz
CONFIG_IP_NF_IPTABLES_LEGACY=y
CONFIG_IP_NF_IPTABLES=y
# CONFIG_IP6_NF_IPTABLES is not set

# zgrep MASQUERADE /proc/config.gz
CONFIG_NF_NAT_MASQUERADE=y
CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y
CONFIG_IP_NF_TARGET_MASQUERADE=y

[k8s-ci-robot]

Hi @afbjorklund. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[BenTheElder]

/ok-to-test

[BenTheElder]

Thanks for the PR!

The alternative is building a custom kernel, with full support.

You can disable ipv6 in the docker daemon settings? I think that's the best fix, though kind should gracefully handle this, I do worry the error messages will keep shifting but ... 🤷‍♂️

[afbjorklund]

You can disable ipv6 in the docker daemon settings?

I tried disabling in daemon.json, but it doesn't change.

{
    "ipv6": false
}

There seems to be some open Docker tickets, about this.

"I think there's a misunderstanding here due to misleading docs: the daemon's ipv6 flag doesn't disable ipv6 daemon-wide, but it only controls the availability of IPv6 on the default bridge network."

So I disabled it system-wide, with sysctl (procps).

net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1

But still got that error, when creating the "kind" network.

[aojea]

it seems the daemon has an option to disable the ip6tables

https://docs.docker.com/engine/daemon/ipv6/#docker-in-docker

Alternatively, use daemon option --ip6tables=false to disable ip6tables for the containerized Docker Engine

[BenTheElder]

Interesting, thanks.

[BenTheElder]

We should maybe rename and clarify this one versus the new error. That shouldn't block fixing the bug though

[BenTheElder]

/lgtm
/approve
/hold

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: afbjorklund, BenTheElder

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [BenTheElder]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[BenTheElder]

/hold cancel
IMO we can iterate on nits, let's land the bug fix