vpdmn: switch to nftables and add kernel config for netavark

Netavark dropped iptables support entirely and now uses nft directly
for firewall rules (masquerade, DNAT, connection tracking). The vpdmn
rootfs had iptables installed but the vruntime kernel had
CONFIG_NF_TABLES disabled, causing netavark to fail at runtime with
"Protocol not supported" when trying to initialize the nftables
Netlink socket.

Replace iptables with nftables in vpdmn-rootfs-image IMAGE_INSTALL
and add container-net.cfg kernel config fragment enabling NF_TABLES,
NFT_MASQ, NFT_NAT, NFT_CT, NFT_FIB and related options required by
netavark's nftables firewall driver.

The fragment is gated on the vcontainer DISTRO_FEATURE so it only
applies to vruntime/vcontainer kernels, not arbitrary builds that
happen to include meta-virtualization.

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>

3 files changed, 22 insertions, 1 deletions

diff --git a/recipes-containers/vcontainer/vpdmn-rootfs-image.bb b/recipes-containers/vcontainer/vpdmn-rootfs-image.bb
index cca9191f..909e1298 100644
--- a/recipes-containers/vcontainer/vpdmn-rootfs-image.bb
+++ b/recipes-containers/vcontainer/vpdmn-rootfs-image.bb
@@ -54,7 +54,7 @@ IMAGE_INSTALL = " \
     aardvark-dns \
     busybox \
     iproute2 \
-    iptables \
+    nftables \
     util-linux \
     ca-certificates \
 "
diff --git a/recipes-kernel/linux/linux-yocto/container-net.cfg b/recipes-kernel/linux/linux-yocto/container-net.cfg
new file mode 100644
index 00000000..74b567d7
--- /dev/null
+++ b/recipes-kernel/linux/linux-yocto/container-net.cfg
@@ -0,0 +1,20 @@
+# nftables support for container networking (netavark)
+CONFIG_NF_TABLES=y
+CONFIG_NF_TABLES_INET=y
+CONFIG_NFT_CT=y
+CONFIG_NFT_LOG=y
+CONFIG_NFT_LIMIT=y
+CONFIG_NFT_MASQ=y
+CONFIG_NFT_NAT=y
+CONFIG_NFT_REJECT=y
+CONFIG_NFT_REJECT_INET=y
+CONFIG_NFT_COMPAT=y
+CONFIG_NFT_FIB=y
+CONFIG_NFT_FIB_INET=y
+CONFIG_NFT_FIB_IPV4=y
+CONFIG_NFT_FIB_IPV6=y
+
+# Connection tracking (required by nftables ct and masquerade)
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_NAT=y
+CONFIG_NF_NAT_MASQUERADE=y
diff --git a/recipes-kernel/linux/linux-yocto_virtualization.inc b/recipes-kernel/linux/linux-yocto_virtualization.inc
index 486e77ce..2cf1df74 100644
--- a/recipes-kernel/linux/linux-yocto_virtualization.inc
+++ b/recipes-kernel/linux/linux-yocto_virtualization.inc
@@ -112,6 +112,7 @@ KERNEL_FEATURES:append = "${@distro_cond_feature('cgl/features/selinux/selinux.c
 
 # vcontainer
 KERNEL_FEATURES:append = "${@distro_cond_feature('cfg/container.scc', 'vcontainer', d)}"
+SRC_URI += "${@bb.utils.contains('DISTRO_FEATURES', 'vcontainer', ' file://container-net.cfg', '', d)}"
 
 # vxn: Xen PV guest support for vcontainer-on-Xen
 SRC_URI += "${@bb.utils.contains('DISTRO_FEATURES', 'vxn', ' file://vxn.cfg', '', d)}"