docker issue with linux-rpi 6.18-1

[Rapty]

Hello community

Something is not going well between docker and linux-rpi 6.18-1.
I don't know yet what, but I suggest to not update if you're dependent of containers.

[graysky]

When you identify a cause, and if it is due to an upstream bug, the RPi Foundation devs are eager to help. Open a ticket:make_clickable_callback(MAGIC_URL_FULL, ' ', 'https://github.com/raspberrypi/linux/issues', '', ' class="postlink"')

Just make sure it's to do with upstream code and not a config option I may have missed.

[midixinga]

I have the same problem:

journalctl -b | grep docker:

Dec 14 09:12:39 alarm dockerd[377]: time="2025-12-14T09:12:39.246025202+01:00" level=info msg="Starting up"
Dec 14 09:12:39 alarm dockerd[377]: time="2025-12-14T09:12:39.265515098+01:00" level=info msg="OTEL tracing is not configured, using no-op tracer provider"
Dec 14 09:12:39 alarm dockerd[377]: time="2025-12-14T09:12:39.267429056+01:00" level=info msg="CDI directory does not exist, skipping: failed to monitor for changes: no such file or directory" dir=/etc/cdi
Dec 14 09:12:39 alarm dockerd[377]: time="2025-12-14T09:12:39.267585358+01:00" level=info msg="CDI directory does not exist, skipping: failed to monitor for changes: no such file or directory" dir=/var/run/cdi
Dec 14 09:12:39 alarm dockerd[377]: time="2025-12-14T09:12:39.361033692+01:00" level=info msg="Creating a containerd client" address=/run/containerd/containerd.sock timeout=1m0s
Dec 14 09:12:39 alarm dockerd[377]: time="2025-12-14T09:12:39.645840567+01:00" level=info msg="Loading containers: start."
Dec 14 09:12:42 alarm systemd[1]: var-lib-docker-overlay2-metacopy\x2dcheck1553701852-merged.mount: Deactivated successfully.
Dec 14 09:12:42 alarm dockerd[377]: time="2025-12-14T09:12:42.614798951+01:00" level=info msg="[graphdriver] using prior storage driver: overlay2"
Dec 14 09:12:43 alarm dockerd[377]: time="2025-12-14T09:12:43.096106972+01:00" level=info msg="Restoring containers: start."
Dec 14 09:12:45 alarm dockerd[377]: time="2025-12-14T09:12:45.793377700+01:00" level=info msg="Deleting nftables IPv4 rules" error="exit status 1"
Dec 14 09:12:45 alarm dockerd[377]: time="2025-12-14T09:12:45.826672960+01:00" level=info msg="Deleting nftables IPv6 rules" error="exit status 1"
Dec 14 09:12:46 alarm dockerd[377]: time="2025-12-14T09:12:46.180504158+01:00" level=info msg="stopping event stream following graceful shutdown" error="" module=libcontainerd namespace=moby
Dec 14 09:12:46 alarm dockerd[377]: failed to start daemon: Error initializing network controller: error obtaining controller instance: failed to register "bridge" driver: failed to create NAT chain DOCKER: iptables failed: iptables --wait -t nat -N DOCKER: modprobe: FATAL: Module ip_tables not found in directory /lib/modules/6.18.0-1-rpi
Dec 14 09:12:46 alarm dockerd[377]: iptables v1.8.11 (legacy): can't initialize iptables table nat': Table does not exist (do you need to insmod?) Dec 14 09:12:46 alarm dockerd[377]: Perhaps iptables or your kernel needs to be upgraded. Dec 14 09:12:46 alarm dockerd[377]: (exit status 3) Dec 14 09:12:46 alarm systemd[1]: docker.service: Main process exited, code=exited, status=1/FAILURE Dec 14 09:12:46 alarm systemd[1]: docker.service: Failed with result 'exit-code'. Dec 14 09:12:46 alarm systemd[1]: docker.service: Consumed 1.331s CPU time. Dec 14 09:12:48 alarm systemd[1]: docker.service: Scheduled restart job, restart counter is at 1. Dec 14 09:12:48 alarm dockerd[470]: time="2025-12-14T09:12:48.664652959+01:00" level=info msg="Starting up" Dec 14 09:12:48 alarm dockerd[470]: time="2025-12-14T09:12:48.667008584+01:00" level=info msg="OTEL tracing is not configured, using no-op tracer provider" Dec 14 09:12:48 alarm dockerd[470]: time="2025-12-14T09:12:48.667550199+01:00" level=info msg="CDI directory does not exist, skipping: failed to monitor for changes: no such file or directory" dir=/var/run/cdi Dec 14 09:12:48 alarm dockerd[470]: time="2025-12-14T09:12:48.667665407+01:00" level=info msg="CDI directory does not exist, skipping: failed to monitor for changes: no such file or directory" dir=/etc/cdi Dec 14 09:12:48 alarm dockerd[470]: time="2025-12-14T09:12:48.707495303+01:00" level=info msg="Creating a containerd client" address=/run/containerd/containerd.sock timeout=1m0s Dec 14 09:12:48 alarm dockerd[470]: time="2025-12-14T09:12:48.722381344+01:00" level=info msg="Loading containers: start." Dec 14 09:12:48 alarm systemd[1]: var-lib-docker-overlay2-metacopy\x2dcheck2433385503-merged.mount: Deactivated successfully. Dec 14 09:12:49 alarm dockerd[470]: time="2025-12-14T09:12:49.032592021+01:00" level=info msg="[graphdriver] using prior storage driver: overlay2" Dec 14 09:12:49 alarm dockerd[470]: time="2025-12-14T09:12:49.077996344+01:00" level=info msg="Restoring containers: start." Dec 14 09:12:49 alarm dockerd[470]: time="2025-12-14T09:12:49.814752646+01:00" level=info msg="Deleting nftables IPv4 rules" error="exit status 1" Dec 14 09:12:49 alarm dockerd[470]: time="2025-12-14T09:12:49.850855719+01:00" level=info msg="Deleting nftables IPv6 rules" error="exit status 1" Dec 14 09:12:50 alarm dockerd[470]: time="2025-12-14T09:12:50.181433115+01:00" level=info msg="stopping event stream following graceful shutdown" error="<nil>" module=libcontainerd namespace=moby Dec 14 09:12:50 alarm dockerd[470]: failed to start daemon: Error initializing network controller: error obtaining controller instance: failed to register "bridge" driver: failed to create NAT chain DOCKER: iptables failed: iptables --wait -t nat -N DOCKER: modprobe: FATAL: Module ip_tables not found in directory /lib/modules/6.18.0-1-rpi Dec 14 09:12:50 alarm dockerd[470]: iptables v1.8.11 (legacy): can't initialize iptables table nat': Table does not exist (do you need to insmod?)
Dec 14 09:12:50 alarm dockerd[470]: Perhaps iptables or your kernel needs to be upgraded.
Dec 14 09:12:50 alarm dockerd[470]: (exit status 3)
Dec 14 09:12:50 alarm systemd[1]: docker.service: Main process exited, code=exited, status=1/FAILURE
Dec 14 09:12:50 alarm systemd[1]: docker.service: Failed with result 'exit-code'.
Dec 14 09:12:52 alarm systemd[1]: docker.service: Scheduled restart job, restart counter is at 2.
Dec 14 09:12:52 alarm dockerd[558]: time="2025-12-14T09:12:52.566184728+01:00" level=info msg="Starting up"
Dec 14 09:12:52 alarm dockerd[558]: time="2025-12-14T09:12:52.568432489+01:00" level=info msg="OTEL tracing is not configured, using no-op tracer provider"
Dec 14 09:12:52 alarm dockerd[558]: time="2025-12-14T09:12:52.568964937+01:00" level=info msg="CDI directory does not exist, skipping: failed to monitor for changes: no such file or directory" dir=/etc/cdi
Dec 14 09:12:52 alarm dockerd[558]: time="2025-12-14T09:12:52.569074572+01:00" level=info msg="CDI directory does not exist, skipping: failed to monitor for changes: no such file or directory" dir=/var/run/cdi
Dec 14 09:12:52 alarm dockerd[558]: time="2025-12-14T09:12:52.610016239+01:00" level=info msg="Creating a containerd client" address=/run/containerd/containerd.sock timeout=1m0s
Dec 14 09:12:52 alarm dockerd[558]: time="2025-12-14T09:12:52.732474207+01:00" level=info msg="Loading containers: start."
Dec 14 09:12:53 alarm systemd[1]: var-lib-docker-overlay2-metacopy\x2dcheck3623294974-merged.mount: Deactivated successfully.
Dec 14 09:12:53 alarm dockerd[558]: time="2025-12-14T09:12:53.271272489+01:00" level=info msg="[graphdriver] using prior storage driver: overlay2"
Dec 14 09:12:53 alarm dockerd[558]: time="2025-12-14T09:12:53.320459155+01:00" level=info msg="Restoring containers: start."
Dec 14 09:12:53 alarm dockerd[558]: time="2025-12-14T09:12:53.558692488+01:00" level=info msg="Deleting nftables IPv4 rules" error="exit status 1"
Dec 14 09:12:53 alarm dockerd[558]: time="2025-12-14T09:12:53.582685405+01:00" level=info msg="Deleting nftables IPv6 rules" error="exit status 1"
Dec 14 09:12:53 alarm dockerd[558]: time="2025-12-14T09:12:53.916179988+01:00" level=info msg="stopping event stream following graceful shutdown" error="" module=libcontainerd namespace=moby
Dec 14 09:12:53 alarm dockerd[558]: failed to start daemon: Error initializing network controller: error obtaining controller instance: failed to register "bridge" driver: failed to create NAT chain DOCKER: iptables failed: iptables --wait -t nat -N DOCKER: modprobe: FATAL: Module ip_tables not found in directory /lib/modules/6.18.0-1-rpi
Dec 14 09:12:53 alarm dockerd[558]: iptables v1.8.11 (legacy): can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Dec 14 09:12:53 alarm dockerd[558]: Perhaps iptables or your kernel needs to be upgraded.
Dec 14 09:12:53 alarm dockerd[558]: (exit status 3)
Dec 14 09:12:53 alarm systemd[1]: docker.service: Main process exited, code=exited, status=1/FAILURE
Dec 14 09:12:53 alarm systemd[1]: docker.service: Failed with result 'exit-code'.
Dec 14 09:12:56 alarm systemd[1]: docker.service: Scheduled restart job, restart counter is at 3.
Dec 14 09:12:56 alarm systemd[1]: docker.service: Start request repeated too quickly.
Dec 14 09:12:56 alarm systemd[1]: docker.service: Failed with result 'exit-code'.
Dec 14 09:12:56 alarm systemd[1]: docker.socket: Failed with result 'service-start-limit-hit'.

[Rapty]

Hello graysky

Yes, sure !
Someone did actually:
[url]https://github.com/raspberrypi/linux/issues/7175[/url]
I don't know if @diximinga is over here also.

I found a workaround: problem is iptables module is no more provided in linux-rpi 6.18-1 (it's different in Arch x86).

Solution is to use `iptables-nft` as a drop in replacement as suggest heremake_clickable_callback(MAGIC_URL_LOCAL, '
', 'https://archlinuxarm.org/forum', 'viewtopic.php?f=15&t=17350', ' class="postlink-local"')
for linux-armv7-6.17.8-1 by @sehraf

EDIT: hello @midixinga I guess you are diximinga

[midixinga]

Hi Rapty,

thx a lot

[root@alarm ~]# pacman -S iptables-nft
resolving dependencies...
looking for conflicting packages...
:: iptables-nft-1:1.8.11-2 and iptables-1:1.8.11-2 are in conflict. Remove iptables? [y/N] y

solved the issue

[Rapty]

According to our doc:
[quote]It is probably best to not use iptables-nft to prevent docker from mixing nftables and iptables rules.[/quote]
make_clickable_callback(MAGIC_URL_FULL, '(', 'https://wiki.archlinux.org/title/Nftables#Working_with_Docker', '', ' class="postlink"'))

Issue is not solved completely, it's just a quick workaround.

[zebul666]

the issuemake_clickable_callback(MAGIC_URL_FULL, ' ', 'https://github.com/raspberrypi/linux/issues/7175', '', ' class="postlink"') is linking back here and was closed just because of the existence of this thread

@graysky the problem is the ip_tables modules is not present anymore in the new 6.18 linux package. Why is that?

That module is still present in the x86_64 package of archlinux linux-6.18.1

[Rapty]

I don't think graysky has something to do with that.
It's up to whoever compile the kernel.

Raspberry foundation seems to have remove ip_tables module from its kernel compilation, but Arch x86 doesn't.

[graysky]

Yeah, iptables have been deprecated upstream. I can enabled the legacy iptables if there is a use case.