Skip to content

Remove iptables references from tests, docs and WSL config #27555

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Nov 21, 2025
Merged

Remove iptables references from tests, docs and WSL config #27555

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9c2a738
Stop enforcing iptables on WSL
l0rd Nov 17, 2025
db9e0b9
Remove iptables references in system tests
l0rd Nov 18, 2025
bd02d6f
Remove iptables from Podman prerequisites
l0rd Nov 18, 2025
aa5361a
Remove iptables references in upgrade tests
l0rd Nov 18, 2025
343a196
Remove iptables references in docs
l0rd Nov 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion .cirrus.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1090,7 +1090,9 @@ upgrade_test_task:
depends_on: *build
matrix:
- env:
PODMAN_UPGRADE_FROM: v4.8.0
PODMAN_UPGRADE_FROM: v5.3.1
- env:
PODMAN_UPGRADE_FROM: v5.6.2
Copy link
Member

@Luap99 Luap99 Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The point of the upgrade tests is to have a relative large delta as well.

What was the first podman image that has netavark with nftables support? We should tests that one as well in addition to 5.6.

Copy link
Member Author

@l0rd l0rd Nov 18, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nftables support has been introduced in netavark v1.10.0 and the first podman image to include it is v4.9.0.

However the upgrade test from v4.9.0 is failing (podman network disconnect fails with Error removing subnet 10.88.0.0/16 from firewalld trusted zone: org.fedoraproject.FirewallD1.Exception: UNKNOWN_SOURCE: '10.88.0.0/16' is not in any zone).

The upgrade from v5.6.2 is failing too (in this case it's the output of podman images that doesn't match, probably because of a change in images order) and upgrade test from v5.5.0 fails for the same reason.

I am setting PODMAN_UPGRADE_FROM: v5.3.1 for now as this is the first version that works locally for me. I will open a separate issue for fixing/adding the test to upgrade from v5.6.2 to current.

Copy link
Member

@Luap99 Luap99 Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

However the upgrade test from v4.9.0 is failing (podman network disconnect fails with Error removing subnet 10.88.0.0/16 from firewalld trusted zone: org.fedoraproject.FirewallD1.Exception: UNKNOWN_SOURCE: '10.88.0.0/16' is not in any zone).

Weird, as a general rule we likely should not fail on removal if it doesn't exits, we should treat it as NOP. But yeah it is old enough that I don't think we need to test updating from that.

I am setting PODMAN_UPGRADE_FROM: v5.3.1 for now as this is the first version that works locally for me. I will open a separate issue for fixing/adding the test to upgrade from v5.6.2 to current.

SGTM

Copy link
Member Author

@l0rd l0rd Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have made a change so that testing the upgrade from v5.6.2 works too. I have updated .cirrus.yml to run both v5.3.1 and v5.6.2 test cases.

Copy link
Member Author

@l0rd l0rd Nov 19, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have opened containers/automation_images#427 to add the new images in the local registry (tests fail otherwise).

gce_instance: *standardvm
env:
TEST_FLAVOR: upgrade_test
Expand Down
6 changes: 3 additions & 3 deletions docs/source/locale/ja/LC_MESSAGES/markdown.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20503,9 +20503,9 @@ msgstr ""

#: ../../source/markdown/podman-network-reload.1.md:13
msgid ""
"Rootful Podman relies on iptables rules in order to provide network "
"connectivity. If the iptables rules are deleted, this happens for example"
" with `firewall-cmd --reload`, the container loses network connectivity. "
"Rootful Podman relies on firewall rules in order to provide network "
"connectivity. If the firewall rules are deleted, as can happen"
" with the `firewall-cmd --reload` command, the container loses network connectivity. "
"This command restores the network connectivity."
msgstr ""

Expand Down
2 changes: 1 addition & 1 deletion docs/source/markdown/podman-network-reload.1.md.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ podman\-network\-reload - Reload network configuration for containers
## DESCRIPTION
Reload one or more container network configurations.

Rootful Podman relies on iptables rules in order to provide network connectivity. If the iptables rules are deleted,
Rootful Podman relies on the firewall rules in order to provide network connectivity. If the firewall rules are deleted,
this happens for example with `firewall-cmd --reload`, the container loses network connectivity. This command restores
the network connectivity.

Expand Down
5 changes: 0 additions & 5 deletions pkg/machine/wsl/declares.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,6 @@ const containersConf = `[containers]
[engine]
cgroup_manager = "cgroupfs"
# Using iptables until we fix nftables on WSL:
# https://github.com/containers/podman/issues/25201
[network]
firewall_driver="iptables"
`

const registriesConf = `unqualified-search-registries=["docker.io"]
Expand Down
6 changes: 0 additions & 6 deletions rpm/podman.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -349,12 +349,6 @@ ln -s ../virtiofsd %{buildroot}%{_libexecdir}/%{name}
%{_tmpfilesdir}/%{name}.conf
%{_systemdgeneratordir}/%{name}-system-generator
%{_systemdusergeneratordir}/%{name}-user-generator
# iptables modules are only needed with iptables-legacy,
# as of f41 netavark will default to nftables so do not load unessary modules
# https://fedoraproject.org/wiki/Changes/NetavarkNftablesDefault
%if %{defined fedora} && 0%{?fedora} < 41
%{_modulesloaddir}/%{name}-iptables.conf
%endif

%files docker
%{_bindir}/docker
Expand Down
1 change: 0 additions & 1 deletion test/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,6 @@ The test currently depend on:
- xz
- htpasswd
- iproute2
- iptables
- util-linux
- tar
- docker
Expand Down
9 changes: 3 additions & 6 deletions test/system/500-networking.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -320,7 +320,7 @@ load helpers.network
run_podman 1 network rm $mynetname
}

# CANNOT BE PARALLELIZED due to iptables/nft commands
# CANNOT BE PARALLELIZED due to nft commands
@test "podman network reload" {
skip_if_remote "podman network reload does not have remote support"

Expand Down Expand Up @@ -356,20 +356,17 @@ load helpers.network
# rootless cannot modify the host firewall
if ! is_rootless; then
# for debugging only
iptables -t nat -nvL || true
nft list ruleset || true

# flush the firewall rule here to break port forwarding
# netavark can use either iptables or nftables, so try flushing both
iptables -t nat -F "NETAVARK-HOSTPORT-DNAT" || true
nft delete table inet netavark || true

# check that we cannot curl (timeout after 1 sec)
run curl --max-time 1 -s $SERVER/index.txt
assert $status -eq 28 "curl did not time out"
fi

# reload the network to recreate the iptables rules
# reload the network to recreate the nftables rules
run_podman network reload $cid
is "$output" "$cid" "Output does match container ID"

Expand Down Expand Up @@ -400,7 +397,7 @@ load helpers.network
mac2="${lines[2]}"

# make sure --all is working and that this
# cmd also works if the iptables still exists
# cmd also works if the nftables still exists
run_podman network reload --all
is "$output" "$cid" "Output does match container ID"

Expand Down
17 changes: 7 additions & 10 deletions test/upgrade/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,22 +21,19 @@ container image from quay.io/podman, uses it to create and run
a number of containers, then uses new-podman to interact with
those containers.

As of 2024-02-05 the available old-podman versions are:
Testing updates from versions earlier than v5.3.1 fails. Testing updates from
tags that do not respect semantic versioning fails too (e.g. v5.6.0-immutable or
v5.6). As of 2025-11-18 the available old-podman versions to test against are:

```console
$ bin/podman search --list-tags --limit=400 quay.io/podman/stable | awk '$2 ~ /^v/ { print $2}' | sort | column -c 75
v1.4.2 v1.9.1 v3.2.0 v3.4.0 v4.1.0 v4.3.1 v4.5.1 v4.8
v1.4.4 v2.0.2 v3.2.1 v3.4.1 v4.1.1 v4.4 v4.6 v4.8.0
v1.5.0 v2.0.6 v3.2.2 v3.4.2 v4.2 v4.4.1 v4.6.1 v4.8.1
v1.5.1 v2.1.1 v3.2.3 v3.4.4 v4.2.0 v4.4.2 v4.6.2 v4.8.2
v1.6 v2.2.1 v3.3.0 v3.4.7 v4.2.1 v4.4.4 v4.7 v4.8.3
v1.6.2 v3 v3.3.1 v4 v4.3 v4.5 v4.7.0 v4.9
v1.9.0 v3.1.2 v3.4 v4.1 v4.3.0 v4.5.0 v4.7.2 v4.9.0
$ bin/podman search --list-tags --limit=400 quay.io/podman/stable | awk '$2 ~ /^v[0-9]+\.[0-9]+\.[0-9]+$/ { print $2}' | sort | awk '/v5.3.1/,0' | column -c 75
v5.3.1 v5.4.0 v5.4.2 v5.5.1 v5.6.0 v5.6.2
v5.3.2 v5.4.1 v5.5.0 v5.5.2 v5.6.1
```

Test invocation is:
```console
$ sudo env PODMAN=bin/podman PODMAN_UPGRADE_FROM=v4.1.0 PODMAN_UPGRADE_TEST_DEBUG= bats test/upgrade
$ sudo env PODMAN=bin/podman PODMAN_UPGRADE_FROM=v5.3.1 PODMAN_UPGRADE_TEST_DEBUG= bats test/upgrade
```
(Path assumes you're cd'ed to top-level podman repo). `PODMAN_UPGRADE_FROM`
can be any of the versions above. `PODMAN_UPGRADE_TEST_DEBUG` is empty
Expand Down
27 changes: 7 additions & 20 deletions test/upgrade/test-upgrade.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,9 +49,9 @@ setup() {
# the default c/storage behavior is to make the mount propagation private.
export _PODMAN_TEST_OPTS="--storage-opt=skip_mount_home=true --cgroup-manager=cgroupfs --root=$PODMAN_UPGRADE_WORKDIR/root --runroot=$PODMAN_UPGRADE_WORKDIR/runroot --tmpdir=$PODMAN_UPGRADE_WORKDIR/tmp"

# Old netavark used iptables but newer versions might uses nftables.
# Networking can only work correctly if both use the same firewall driver so force iptables.
printf "[network]\nfirewall_driver=\"iptables\"\n" > $PODMAN_UPGRADE_WORKDIR/containers.conf

# Starting with v6.0.0 we only test upgrade from versions that support nftables.
printf "[network]\nfirewall_driver=\"nftables\"\n" > $PODMAN_UPGRADE_WORKDIR/containers.conf
export CONTAINERS_CONF_OVERRIDE=$PODMAN_UPGRADE_WORKDIR/containers.conf
}

Expand All @@ -64,21 +64,6 @@ setup() {
OLD_PODMAN=quay.io/podman/stable:$PODMAN_UPGRADE_FROM
$PODMAN pull $OLD_PODMAN

# Can't mix-and-match iptables.
# This can only fail when we bring in new CI VMs. If/when it does fail,
# we'll need to figure out how to solve it. Until then, punt.
iptables_old_version=$($PODMAN run --rm $OLD_PODMAN iptables -V)
run -0 expr "$iptables_old_version" : ".*(\(.*\))"
iptables_old_which="$output"

iptables_new_version=$(iptables -V)
run -0 expr "$iptables_new_version" : ".*(\(.*\))"
iptables_new_which="$output"

if [[ "$iptables_new_which" != "$iptables_old_which" ]]; then
die "Cannot mix iptables; $PODMAN_UPGRADE_FROM container uses $iptables_old_which, host uses $iptables_new_which"
fi

# Shortcut name, because we're referencing it a lot
pmroot=$PODMAN_UPGRADE_WORKDIR

Expand Down Expand Up @@ -223,8 +208,10 @@ EOF

@test "images" {
run_podman images -a --format '{{.Names}}'
assert "${lines[0]}" =~ "\[localhost/podman-pause:${PODMAN_UPGRADE_FROM##v}-.*\]" "podman images, line 0"
assert "${lines[1]}" = "[$IMAGE]" "podman images, line 1"
# Filter out the podman-pause image which isn't present for
# versions >= 5.5.0
run -0 grep -v "localhost/podman-pause" <<< "$output"
assert "${lines[0]}" = "[$IMAGE]" "podman images, line 0"
}

@test "ps : one container running" {
Expand Down