From 8d32add3f9cdca9c8b05578bba0d3a8ff16d6b44 Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Mon, 27 Jul 2026 00:53:50 -0700 Subject: [PATCH 1/2] fix(os/mkosi): enable Docker IPv4 NAT modules --- os/mkosi/components/kernel/kernel.config | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/os/mkosi/components/kernel/kernel.config b/os/mkosi/components/kernel/kernel.config index 8b6960a4f..30d16f6bd 100644 --- a/os/mkosi/components/kernel/kernel.config +++ b/os/mkosi/components/kernel/kernel.config @@ -113,6 +113,15 @@ CONFIG_NF_TABLES=m CONFIG_NFT_COMPAT=m CONFIG_NF_NAT=m CONFIG_NETFILTER_XTABLES=m +# Docker uses the iptables-nft frontend, whose compatibility path still needs +# the IPv4 iptables NAT modules to program published container ports. +CONFIG_IP_NF_IPTABLES=m +CONFIG_IP_NF_FILTER=m +CONFIG_IP_NF_MANGLE=m +CONFIG_IP_NF_NAT=m +CONFIG_IP_NF_TARGET_MASQUERADE=m +CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m +CONFIG_NETFILTER_XT_MARK=m CONFIG_IP_SET=m CONFIG_IP_VS=m CONFIG_IPVLAN=m From 418bb84349fe2eedd407ece751dcb581e7cee093 Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Mon, 27 Jul 2026 01:00:53 -0700 Subject: [PATCH 2/2] fix(os/mkosi): use current xtables NAT symbols --- os/mkosi/components/kernel/kernel.config | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/os/mkosi/components/kernel/kernel.config b/os/mkosi/components/kernel/kernel.config index 30d16f6bd..ef7f0db4d 100644 --- a/os/mkosi/components/kernel/kernel.config +++ b/os/mkosi/components/kernel/kernel.config @@ -114,12 +114,9 @@ CONFIG_NFT_COMPAT=m CONFIG_NF_NAT=m CONFIG_NETFILTER_XTABLES=m # Docker uses the iptables-nft frontend, whose compatibility path still needs -# the IPv4 iptables NAT modules to program published container ports. -CONFIG_IP_NF_IPTABLES=m -CONFIG_IP_NF_FILTER=m -CONFIG_IP_NF_MANGLE=m -CONFIG_IP_NF_NAT=m -CONFIG_IP_NF_TARGET_MASQUERADE=m +# the xtables NAT targets to program published container ports. +CONFIG_NETFILTER_XT_NAT=m +CONFIG_NETFILTER_XT_TARGET_MASQUERADE=m CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m CONFIG_NETFILTER_XT_MARK=m CONFIG_IP_SET=m