Closed
Description
I've been doing this tutorial and had trouble at the step:
DJANGO_APP=$(docker run -d -i -t -p 8000:8000 ubuntu /bin/bash)
WARNING: Docker detected local DNS server on resolv.conf. Using default external servers: [8.8.8.8 8.8.4.4]
WARNING: IPv4 forwarding is disabled.
2013/09/12 12:52:02 Error: Error starting container 037aac8ca3ab: iptables failed: iptables -t nat -A DOCKER -p tcp --dport 8000 ! -i docker0 -j DNAT --to-destination 172.17.0.3:8000
So trying it manually gave me this:
sudo iptables -t nat -A DOCKER -p tcp --dport 8000 ! -i docker0 -j DNAT --to-destination 172.17.0.3:8000
iptables: No chain/target/match by that name.
This is verified by checking (note: I deleted the rules, just kept the chain names):
sudo iptables -L -n --line-numbers
Chain INPUT (policy DROP)
...
Chain FORWARD (policy DROP)
...
Chain OUTPUT (policy DROP)
...
Chain INBOUND (4 references)
...
Chain LOG_FILTER (5 references)
...
Chain LSI (2 references)
...
Chain LSO (0 references)
...
Chain OUTBOUND (3 references)
...
Any ideas? I did have an issues just before this where I couldn't access the internet at all from within containers, but "sharing" the internet locally with device docker0 using firestarter (gufw just doesn't work on my ubuntu 12.04) fixed it.
Activity
crosbymichael commentedon Oct 4, 2013
@Briguy2k
Can you look for the DOCKER chain using
sudo iptables -L -n -t nat
??clemtibs commentedon Oct 4, 2013
@crosbymichael
I didn't see anything helpful there:
matteosister commentedon Nov 9, 2013
same problem here....any solution?
crosbymichael commentedon Nov 9, 2013
@brianclements @matteosister
I'm guessing that you have the docker0 bridge so you can try to create the chain manually.
iptables -t nat -N DOCKER iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL ! --dst 127.0.0.0/8 -j DOCKER
matteosister commentedon Nov 10, 2013
@crosbymichael I've got the docker0 bridge, but the commands you gave didn't solve the issue....
Is there a way to restart from scratch?
crosbymichael commentedon Nov 10, 2013
You can remove the docker0 bridge and have docker recreate the network setup.
Michael Crosby
clemtibs commentedon Nov 14, 2013
@crosbymichael
Your suggestions worked for me and I was finally able to complete the tutorial in the original post exactly as directed, even down to the working django web server. However when I restarted, all the iptables changes were undone. Any tips on where I should start looking to make those permanent?
matteosister commentedon Nov 18, 2013
@crosbymichael for me nothing worked. Even after deleting the bridge still gives me the same error...
crosbymichael commentedon Nov 30, 2013
@matteosister What host OS are you running on?
shykes commentedon Jan 6, 2014
Tagging as /system/networking
jpoimboe commentedon Jan 24, 2014
@brianclements @matteosister do you still see the issue with the latest version of docker?
clemtibs commentedon Jan 24, 2014
Thanks for following up @jpoimboe, I have since installed docker on many other machines and had 0 occurrence of this issue on those machines. And I'm pretty sure that I've had other miscellaneous firewall issues on the machine that this issue was occurring on, so I'm going to go ahead and take myself out of this equation and say that it's some issue with my firewall here on this machine and not docker.
Curious though myself @matteosister, what is your host system that you have the issue on and is it a fresh install or a system upgrade? My particular system has been under probably 3 years of Ubuntu upgrades and I think my iptables has too many different versions and types of firewalls all grabbing at it and undoing each others changes.
eliasp commentedon Jan 24, 2014
@brianclements It still fails here:
Running
iptables -t nat -L
shows:There's no other firewall framework/daemon (Shorewall, firewalld, ufw, …) enabled/active at the time of testing this, so there's no chance this is a conflict with any of them.
tianon commentedon Jan 24, 2014
@eliasp I wonder if you just found another kernel flag our ebuild is missing. Do you have
CONFIG_NETFILTER_XT_MATCH_CONNTRACK
set in your kernel config, by any chance? :)eliasp commentedon Jan 25, 2014
@tianon That's the culprit:
Added it and it works now! So this should be also added to the ebuild.
33 remaining items