3 files changed, 22 insertions, 1 deletions

diff --git a/recipes-containers/vcontainer/vpdmn-rootfs-image.bb b/recipes-containers/vcontainer/vpdmn-rootfs-image.bb
index cca9191f..909e1298 100644
--- a/recipes-containers/vcontainer/vpdmn-rootfs-image.bb
+++ b/recipes-containers/vcontainer/vpdmn-rootfs-image.bb
@@ -54,7 +54,7 @@ IMAGE_INSTALL = " \
     aardvark-dns \
     busybox \
     iproute2 \
-    iptables \
+    nftables \
     util-linux \
     ca-certificates \
 "
diff --git a/recipes-kernel/linux/linux-yocto/container-net.cfg b/recipes-kernel/linux/linux-yocto/container-net.cfg
new file mode 100644
index 00000000..74b567d7
--- /dev/null
+++ b/recipes-kernel/linux/linux-yocto/container-net.cfg
@@ -0,0 +1,20 @@
+# nftables support for container networking (netavark)
+CONFIG_NF_TABLES=y
+CONFIG_NF_TABLES_INET=y
+CONFIG_NFT_CT=y
+CONFIG_NFT_LOG=y
+CONFIG_NFT_LIMIT=y
+CONFIG_NFT_MASQ=y
+CONFIG_NFT_NAT=y
+CONFIG_NFT_REJECT=y
+CONFIG_NFT_REJECT_INET=y
+CONFIG_NFT_COMPAT=y
+CONFIG_NFT_FIB=y
+CONFIG_NFT_FIB_INET=y
+CONFIG_NFT_FIB_IPV4=y
+CONFIG_NFT_FIB_IPV6=y
+
+# Connection tracking (required by nftables ct and masquerade)
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_NAT=y
+CONFIG_NF_NAT_MASQUERADE=y
diff --git a/recipes-kernel/linux/linux-yocto_virtualization.inc b/recipes-kernel/linux/linux-yocto_virtualization.inc
index 486e77ce..2cf1df74 100644
--- a/recipes-kernel/linux/linux-yocto_virtualization.inc
+++ b/recipes-kernel/linux/linux-yocto_virtualization.inc
@@ -112,6 +112,7 @@ KERNEL_FEATURES:append = "${@distro_cond_feature('cgl/features/selinux/selinux.c
 
 # vcontainer
 KERNEL_FEATURES:append = "${@distro_cond_feature('cfg/container.scc', 'vcontainer', d)}"
+SRC_URI += "${@bb.utils.contains('DISTRO_FEATURES', 'vcontainer', ' file://container-net.cfg', '', d)}"
 
 # vxn: Xen PV guest support for vcontainer-on-Xen
 SRC_URI += "${@bb.utils.contains('DISTRO_FEATURES', 'vxn', ' file://vxn.cfg', '', d)}"