☰

docker 失败并显示“iptables：没有该名称的链/目标/匹配”

tag-icon • tag-icon iptables docker
docker 失败并显示“iptables：没有该名称的链/目标/匹配”

当我尝试将容器的端口发布到主机时，docker 无法添加 iptables 规则：

$ sudo docker run --rm -p 8080:80 nginx
docker: Error response from daemon: driver failed programming external 
connectivity on endpoint:

iptables failed:
  iptables --wait -t nat -A DOCKER -p tcp -d 0/0
           --dport 8080 -j DNAT --to-destination 172.17.0.2:80 ! -i docker0

 iptables: No chain/target/match by that name. (exit status 1)).

让我困惑的是这条DOCKER链似乎存在：

$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy DROP)
target     prot opt source               destination         
DOCKER-USER  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain DOCKER (2 references)
target     prot opt source               destination         

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination         
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere            

Chain DOCKER-ISOLATION-STAGE-2 (2 references)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere            

Chain DOCKER-USER (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere

...还有这里：

$ sudo iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DOCKER     all  --  anywhere             anywhere             ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DOCKER     all  --  anywhere            !127.0.0.0/8          ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  172.17.0.0/16        anywhere            
MASQUERADE  all  --  172.18.0.0/16        anywhere            

Chain DOCKER (2 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere

也许相关：ip a显示docker0已关闭：

$ ip a
...
74: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
    link/ether 02:42:01:52:de:7d brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever

我尝试停止 docker，删除损坏的docker0设备，然后再次重新启动 docker。同样的错误：

sudo systemctl stop docker.service
sudo ip link del docker0
sudo systemctl start docker.service

ip a仍然显示docker0下降。运行时sudo docker run --rm -p 8080:80 nginx 也会出现与上面相同的错误消息。

系统信息：

$ docker --version
Docker version 18.05.0-ce, build f150324782

$ uname -a
Linux amd8-arch 4.16.7-1-ARCH #1 SMP PREEMPT Wed May 2 21:12:36 UTC 2018 x86_64 GNU/Linux

我正在使用 Arch Linux。

答案1

Docker 18.05.0-ce是第一个版本，其中采用了以下网络功能，

更新 libnetwork 以提高网桥网络隔离规则的可扩展性。莫比/莫比#36774

在此功能中，链Docker 隔离iptable 过滤表中的内容替换为Docker 隔离阶段 1和Docker 隔离阶段 2。

查看发布日志18.05.0-CE。

相关内容