Fix runtime iptables selection for non-root Docker-in-Docker entrypoints

.github/workflows/test-all.yaml

@@ -117,7 +117,7 @@ jobs:
         run: |
           sudo apt-get update && sudo apt-get install -y jq
           sed 's://.*$::' test/docker-in-docker/scenarios.json \
-            | jq 'del(.docker_with_default_iptables, .docker_with_default_iptables_ubuntu)' \
+            | jq 'del(.docker_with_default_iptables, .docker_with_default_iptables_ubuntu, .docker_iptables_switch_at_runtime_non_root)' \
             > test/docker-in-docker/scenarios.json.tmp
           mv test/docker-in-docker/scenarios.json.tmp test/docker-in-docker/scenarios.json
 

.github/workflows/test-pr-arm64.yaml

@@ -80,7 +80,7 @@ jobs:
         run: |
           sudo apt-get update && sudo apt-get install -y jq
           sed 's://.*$::' test/docker-in-docker/scenarios.json \
-            | jq 'del(.docker_with_default_iptables, .docker_with_default_iptables_ubuntu)' \
+            | jq 'del(.docker_with_default_iptables, .docker_with_default_iptables_ubuntu, .docker_iptables_switch_at_runtime_non_root)' \
             > test/docker-in-docker/scenarios.json.tmp
           mv test/docker-in-docker/scenarios.json.tmp test/docker-in-docker/scenarios.json
 

.github/workflows/test-pr.yaml

@@ -96,7 +96,7 @@ jobs:
         run: |
           sudo apt-get update && sudo apt-get install -y jq
           sed 's://.*$::' test/docker-in-docker/scenarios.json \
-            | jq 'del(.docker_with_default_iptables, .docker_with_default_iptables_ubuntu)' \
+            | jq 'del(.docker_with_default_iptables, .docker_with_default_iptables_ubuntu, .docker_iptables_switch_at_runtime_non_root)' \
             > test/docker-in-docker/scenarios.json.tmp
           mv test/docker-in-docker/scenarios.json.tmp test/docker-in-docker/scenarios.json
 
@@ -114,6 +114,7 @@ jobs:
         scenario:
           - docker_with_default_iptables
           - docker_with_default_iptables_ubuntu
+          - docker_iptables_switch_at_runtime_non_root
     steps:
       - uses: actions/checkout@v7
 

src/docker-in-docker/devcontainer-feature.json

@@ -1,6 +1,6 @@
 {
   "id": "docker-in-docker",
-  "version": "4.1.2",
+  "version": "4.1.3",
   "name": "Docker (Docker-in-Docker)",
   "documentationURL": "https://github.com/devcontainers/features/tree/main/src/docker-in-docker",
   "description": "Create child containers *inside* a container, independent from the host's docker instance. Installs Docker extension in the container along with needed CLIs.",

src/docker-in-docker/install.sh

@@ -982,6 +982,17 @@ DOCKER_HOST_GATEWAY_IP=${DOCKER_HOST_GATEWAY_IP}
 DOCKER_DEFAULT_IP6_TABLES=${DOCKER_DEFAULT_IP6_TABLES}
 EOF
 
+tee -a /usr/local/share/docker-init.sh > /dev/null \
+<< 'EOF'
+sudo_if() {
+    if [ "$(id -u)" -ne 0 ]; then
+        sudo "$@"
+    else
+        "$@"
+    fi
+}
+EOF
+
 # On Debian-based images, re-assert the iptables alternative at container start
 # (only when the user opted into runtime switching via iptablesSwitchAtRuntime=true).
 if [ "${IPTABLES_SWITCH_AT_RUNTIME}" = "true" ] && [ "${ADJUSTED_ID}" = "debian" ]; then
@@ -995,12 +1006,12 @@ if type iptables-legacy > /dev/null 2>&1 \
    && { grep -qE '^(ip_tables)\b' /proc/modules \
         || [ -d /sys/module/ip_tables ]; } \
    && update-alternatives --list iptables 2>/dev/null | grep -q '/usr/sbin/iptables-legacy'; then
-    update-alternatives --set iptables  /usr/sbin/iptables-legacy || true
-    update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy || true
+    sudo_if update-alternatives --set iptables  /usr/sbin/iptables-legacy || true
+    sudo_if update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy || true
 elif type iptables-nft > /dev/null 2>&1 \
      && update-alternatives --list iptables 2>/dev/null | grep -q '/usr/sbin/iptables-nft'; then
-    update-alternatives --set iptables  /usr/sbin/iptables-nft  || true
-    update-alternatives --set ip6tables /usr/sbin/ip6tables-nft || true
+    sudo_if update-alternatives --set iptables  /usr/sbin/iptables-nft  || true
+    sudo_if update-alternatives --set ip6tables /usr/sbin/ip6tables-nft || true
 fi
 EOF
 fi
@@ -1130,16 +1141,6 @@ dockerd_start="AZURE_DNS_AUTO_DETECTION=${AZURE_DNS_AUTO_DETECTION} DOCKER_DEFAU
 INNEREOF
 )"
 
-sudo_if() {
-    COMMAND="$*"
-
-    if [ "$(id -u)" -ne 0 ]; then
-        sudo $COMMAND
-    else
-        $COMMAND
-    fi
-}
-
 retry_docker_start_count=0
 docker_ok="false"
 

test/docker-in-docker/docker_iptables_switch_at_runtime_non_root.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+set -e
+
+# Optional: Import test library
+source dev-container-features-test-lib
+
+check "entrypoint runs as codespace" bash -c "test \"$(id -un)\" = codespace"
+check "iptables uses legacy backend" bash -c "iptables --version | grep -q '(legacy)'"
+
+# Report result
+reportResults

test/docker-in-docker/docker_iptables_switch_at_runtime_non_root/Dockerfile

@@ -0,0 +1,3 @@
+FROM ubuntu:noble
+
+RUN if id ubuntu > /dev/null 2>&1; then userdel -f -r ubuntu; fi

test/docker-in-docker/scenarios.json

@@ -36,6 +36,24 @@
         },
         "initializeCommand": "sudo modprobe ip_tables"
     },
+    "docker_iptables_switch_at_runtime_non_root": {
+        "build": {
+            "dockerfile": "Dockerfile"
+        },
+        "containerUser": "codespace",
+        "remoteUser": "codespace",
+        "features": {
+            "common-utils": {
+                "username": "codespace",
+                "userUid": "1000",
+                "userGid": "1000"
+            },
+            "docker-in-docker": {
+                "moby": "false",
+                "iptablesSwitchAtRuntime": true
+            }
+        }
+    },
     "docker_with_default_iptables": {
         "image": "mcr.microsoft.com/devcontainers/base:debian",
         "features": {