在centos8主机iptables复制上运行centos7容器

Question

在centos8主机上运行centos7容器时。在容器中，向一个链中添加一个iptables规则(例如，筛选表输入链)，该规则不仅将被添加到输入链中，还将添加到其他链中(例如输出、前向、甚至PREROUTING、POSTROUTING)。

1. 在centos7主机

上运行centos8容器

docker run -it --privileged centos:8 sh

1. 运行时，在容器

中安装iptable

yum install -y iptables

iptables -V

1. 显示iptables版本

iptables version: v1.8.4 (nf_tables)

iptables -t nat -nvL

1. 列表当前规则

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
# Warning: iptables-legacy tables present, use iptables-legacy to see them

iptables -I INPUT -i eth0 -j REJECT添加了一个新规则：

iptables -nvL

1. 列表规则

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 REJECT     all  --  eth0   *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 REJECT     all  --  eth0   *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 REJECT     all  --  eth0   *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
# Warning: iptables-legacy tables present, use iptables-legacy to see them

如果在centos8主机上运行centos8容器，则不会发生这种情况。

Answer 1

一句话:主机和容器混合iptables和nftable。

https://github.com/kubernetes/kubernetes/issues/71305

https://bugzilla.redhat.com/show_bug.cgi?id=1668007