moby: Docker 18.09.1 doesn't work with iptables v1.8.2

Description

When I try to deploy a container and expose it on a port it failed with this error:

docker run --rm -it -p 80:80 alpine

docker: Error response from daemon: driver failed programming external connectivity on endpoint unruffled_goldwasser (c99e441c46a8317bb62c99bbea46f289fe7a317b54bbe3abe51e83c21d709323):  (iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 80 -j DNAT --to-destination 172.17.0.2:80 ! -i docker0: iptables v1.8.2 (legacy): unknown option "--to-destination"
Try `iptables -h' or 'iptables --help' for more information.
 (exit status 2)).

Steps to reproduce the issue:

Run the above command with iptables 1.8.2

Describe the results you received:

docker run --rm -it -p 80:80 alpine

docker: Error response from daemon: driver failed programming external connectivity on endpoint unruffled_goldwasser (c99e441c46a8317bb62c99bbea46f289fe7a317b54bbe3abe51e83c21d709323):  (iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 80 -j DNAT --to-destination 172.17.0.2:80 ! -i docker0: iptables v1.8.2 (legacy): unknown option "--to-destination"
Try `iptables -h' or 'iptables --help' for more information.
 (exit status 2)).

Output of docker version:

Client:
 Version:           18.09.2-ce
 API version:       1.39
 Go version:        go1.11.5
 Git commit:        62479626f2
 Built:             Mon Feb 11 23:58:17 2019
 OS/Arch:           linux/amd64
 Experimental:      false

Server:
 Engine:
  Version:          18.09.1-ce
  API version:      1.39 (minimum version 1.12)
  Go version:       go1.11.4
  Git commit:       4c52b901c6
  Built:            Thu Jan 10 06:50:46 2019
  OS/Arch:          linux/amd64
  Experimental:     false

Output of docker info:

Containers: 2
 Running: 1
 Paused: 0
 Stopped: 1
Images: 32
Server Version: 18.09.1-ce
Storage Driver: overlay2
 Backing Filesystem: extfs
 Supports d_type: true
 Native Overlay Diff: false
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 9f2e07b1fc1342d1c48fe4d7bbb94cb6d1bf278b.m
runc version: ccb5efd37fb7c86364786e9137e22948751de7ed-dirty
init version: fec3683
Security Options:
 seccomp
  Profile: default
Kernel Version: 4.19.20-1-MANJARO
Operating System: Arch Linux
OSType: linux
Architecture: x86_64
CPUs: 8
Total Memory: 15.49GiB
Name: cwr
ID: TU5A:APOO:S4OL:RAZH:ZCRD:ZKPP:5DCX:JU56:RZH2:QH4X:NMDY:X33X
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false

Output of iptables -V:

iptables v1.8.2 (legacy)

About this issue

Original URL
State: closed
Created 5 years ago
Reactions: 2
Comments: 18 (3 by maintainers)

Links to this issue

https://np.reddit.com/r/pihole/comments/pgladl/cant_start_pihole_on_docker_unknown_iptables/hbsb60q/

Commits related to this issue

add xt_nat module has the following error ``` Failed to start container 6dc39ca555c75c8875fe4feaf5d2ed4cd5cd263fe756cb1be27293dfd90b3e49: API error (500): driver failed programming external connecti... — committed to KyleOndy/home-infra by KyleOndy 3 years ago

Most upvoted comments

For anyone else stumbling upon this issue, this happened to me on Arch Linux after an upgrade and was resolved by a restart—no symlink required.

+24

BenElgar on Mar 17, 2020

Here’s a workaround for arch users:

sudo ln -s /usr/bin/iptables-nft /usr/local/bin/iptables
reboot

See Arch Linux Forums for more details.

+22

ymkjp on Mar 18, 2019

Surprised this is closed. On latest docker latest PhotonOS with iptables v1.8.0 (legacy), it’s broken and I see no workaround above or am I missing something?

.....truncated....
(iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 9443 -j DNAT --to-destination X.X.X.X:443 ! -i docker0: iptables v1.8.0 (legacy): unknown option "--to-destination"
Try `iptables -h' or 'iptables --help' for more information.

Is there any solution?

CollinChaffin on Mar 22, 2019

This is because iptables is failing to load the DNAT module (because of the -j DNAT flag). Make sure you can modprobe xt_nat.

w4 on Sep 7, 2020

Surprised this is closed. On latest docker latest PhotonOS with iptables v1.8.0 (legacy), it’s broken and I see no workaround above or am I missing something?
.....truncated....
(iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 9443 -j DNAT --to-destination X.X.X.X:443 ! -i docker0: iptables v1.8.0 (legacy): unknown option "--to-destination"
Try `iptables -h' or 'iptables --help' for more information.
Is there any solution?

@CollinChaffin I had the same problem as you, so I upgraded iptables to 1.8.2, with that version of iptables the symlink hack:

sudo ln -s /usr/bin/iptables-nft /usr/local/bin/iptables
reboot

Appears to work.

zancas on Apr 26, 2019

I see a similar error on Arch, complaining unknown option "--dport". Note that Arch uses iptables with legacy interface for both iptables and iptables-legacy.

$ uname -r
4.20.12-arch1-1-ARCH
$ iptables --version
iptables v1.8.2 (legacy)
$ iptables-legacy --version
iptables v1.8.2 (legacy)

$ docker run --rm -it -p 80:80 alpine
docker: Error response from daemon: driver failed programming external connectivity on endpoint tender_volhard (954d664336eb5ea7b2c7f808889b3033977b45f53f99ba38bbc66bfcf14a61ef):  (iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 80 -j DNAT --to-destination 172.17.0.2:80 ! -i docker0: iptables v1.8.2 (legacy): unknown option "--dport"
Try `iptables -h' or 'iptables --help' for more information.
 (exit status 2)).

Docker details

Output of docker version:

Client:
 Version:           18.09.3-ce
 API version:       1.39
 Go version:        go1.12
 Git commit:        774a1f4eee
 Built:             Thu Feb 28 20:38:40 2019
 OS/Arch:           linux/amd64
 Experimental:      false

Server:
 Engine:
  Version:          18.09.2-ce
  API version:      1.39 (minimum version 1.12)
  Go version:       go1.11.5
  Git commit:       62479626f2
  Built:            Mon Feb 11 23:55:58 2019
  OS/Arch:          linux/amd64
  Experimental:     false

Output of docker info:

Containers: 93
 Running: 0
 Paused: 0
 Stopped: 93
Images: 558
Server Version: 18.09.2-ce
Storage Driver: overlay2
 Backing Filesystem: extfs
 Supports d_type: true
 Native Overlay Diff: false
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 9f2e07b1fc1342d1c48fe4d7bbb94cb6d1bf278b.m
runc version: ccb5efd37fb7c86364786e9137e22948751de7ed-dirty
init version: fec3683
Security Options:
 seccomp
  Profile: default
Kernel Version: 4.20.12-arch1-1-ARCH
Operating System: Arch Linux
OSType: linux
Architecture: x86_64
CPUs: 8
Total Memory: 31.18GiB
Name: t480arch
ID: S4PH:3NN4:QYPI:Z6MT:SMPC:E3GL:HPMX:RWT7:JPB3:BPB5:TL7T:P36V
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Username: ymkjp
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false

ymkjp on Dec 29, 2020

Try both iptables-nft and iptables-legacy if you’re not sure which one works on your system. In my case I have to link iptables-legacy as iptables to fix it. Hope it helps.

Arnie97 on Sep 4, 2020