From c4f354d38b84f3f2db4875470442db702c47edba Mon Sep 17 00:00:00 2001 From: Bruce Ashfield Date: Thu, 4 Jun 2026 15:41:18 +0000 Subject: vpdmn: switch to nftables and add kernel config for netavark Netavark dropped iptables support entirely and now uses nft directly for firewall rules (masquerade, DNAT, connection tracking). The vpdmn rootfs had iptables installed but the vruntime kernel had CONFIG_NF_TABLES disabled, causing netavark to fail at runtime with "Protocol not supported" when trying to initialize the nftables Netlink socket. Replace iptables with nftables in vpdmn-rootfs-image IMAGE_INSTALL and add container-net.cfg kernel config fragment enabling NF_TABLES, NFT_MASQ, NFT_NAT, NFT_CT, NFT_FIB and related options required by netavark's nftables firewall driver. The fragment is gated on the vcontainer DISTRO_FEATURE so it only applies to vruntime/vcontainer kernels, not arbitrary builds that happen to include meta-virtualization. Signed-off-by: Bruce Ashfield --- recipes-containers/vcontainer/vpdmn-rootfs-image.bb | 2 +- recipes-kernel/linux/linux-yocto/container-net.cfg | 20 ++++++++++++++++++++ recipes-kernel/linux/linux-yocto_virtualization.inc | 1 + 3 files changed, 22 insertions(+), 1 deletion(-) create mode 100644 recipes-kernel/linux/linux-yocto/container-net.cfg diff --git a/recipes-containers/vcontainer/vpdmn-rootfs-image.bb b/recipes-containers/vcontainer/vpdmn-rootfs-image.bb index cca9191f..909e1298 100644 --- a/recipes-containers/vcontainer/vpdmn-rootfs-image.bb +++ b/recipes-containers/vcontainer/vpdmn-rootfs-image.bb @@ -54,7 +54,7 @@ IMAGE_INSTALL = " \ aardvark-dns \ busybox \ iproute2 \ - iptables \ + nftables \ util-linux \ ca-certificates \ " diff --git a/recipes-kernel/linux/linux-yocto/container-net.cfg b/recipes-kernel/linux/linux-yocto/container-net.cfg new file mode 100644 index 00000000..74b567d7 --- /dev/null +++ b/recipes-kernel/linux/linux-yocto/container-net.cfg @@ -0,0 +1,20 @@ +# nftables support for container networking (netavark) +CONFIG_NF_TABLES=y +CONFIG_NF_TABLES_INET=y +CONFIG_NFT_CT=y +CONFIG_NFT_LOG=y +CONFIG_NFT_LIMIT=y +CONFIG_NFT_MASQ=y +CONFIG_NFT_NAT=y +CONFIG_NFT_REJECT=y +CONFIG_NFT_REJECT_INET=y +CONFIG_NFT_COMPAT=y +CONFIG_NFT_FIB=y +CONFIG_NFT_FIB_INET=y +CONFIG_NFT_FIB_IPV4=y +CONFIG_NFT_FIB_IPV6=y + +# Connection tracking (required by nftables ct and masquerade) +CONFIG_NF_CONNTRACK=y +CONFIG_NF_NAT=y +CONFIG_NF_NAT_MASQUERADE=y diff --git a/recipes-kernel/linux/linux-yocto_virtualization.inc b/recipes-kernel/linux/linux-yocto_virtualization.inc index 486e77ce..2cf1df74 100644 --- a/recipes-kernel/linux/linux-yocto_virtualization.inc +++ b/recipes-kernel/linux/linux-yocto_virtualization.inc @@ -112,6 +112,7 @@ KERNEL_FEATURES:append = "${@distro_cond_feature('cgl/features/selinux/selinux.c # vcontainer KERNEL_FEATURES:append = "${@distro_cond_feature('cfg/container.scc', 'vcontainer', d)}" +SRC_URI += "${@bb.utils.contains('DISTRO_FEATURES', 'vcontainer', ' file://container-net.cfg', '', d)}" # vxn: Xen PV guest support for vcontainer-on-Xen SRC_URI += "${@bb.utils.contains('DISTRO_FEATURES', 'vxn', ' file://vxn.cfg', '', d)}" -- cgit v1.2.3-54-g00ecf