1

I'm trying to run docker inside of Ubuntu 22.04.3 LTS running in WSL-2 on my Windows 10 machine.

I have followed the instructions here. But it's still not working, I am getting the following error when I run sudo dockerd :

failed to register "bridge" driver: failed to create NAT chain DOCKER:
       iptables failed: iptables -t nat -N DOCKER:
       iptables v1.8.7 (legacy): can't initialize iptables table `nat':
          Table does not exist (do you need to insmod?)
          Perhaps iptables or your kernel needs to be upgraded.
  (exit status 3)

When I do modprobe ip_tables I get :

modprobe: FATAL: Module ip_tables not found in directory /lib/modules/4.4.0-22621-Microsoft
3
  • Maybe try sudo apt-get install iptables
    – Turdie
    Jan 26 at 4:46
  • @Turdie it's already installed. Tables are empty though. If you read the error closely, iptables does run but raises error "failed to create NAT chain DOCKER"
    – Genku
    Jan 26 at 18:28
  • Yeah I remember having that in the past also with WSL, iptables isn't included and the kernel module also not. Microsoft has modified the Linux kernel for wsl
    – Turdie
    Jan 26 at 22:14

2 Answers 2

1

This is due to a bug in Docker. There are two versions of iptables: the legacy (in the iptables-legacy package) and the wrapper around the newer nftables (in the iptables-nft package). nftables is a much better, more robust system, and so it's the default on newer distros.

However, Docker doesn't work correctly with nftables. However, as outlined in this blog post, it's possible to change to the iptables-legacy package instead. You can install that package and then run sudo update-alternatives --config iptables, choosing the legacy option instead of the nft option, and then restart the docker daemon.

Note also that by default, WSL 2 ships with all kernel modules built in and there are no dynamically loadable modules, so modprobe can't do anything. Part of the reason this is the case is because individual distros create and ship the distro images, not Microsoft, but the kernel is Microsoft's alone. It would be impractical to ship loadable kernel modules, since it would require distros to update their images with Microsoft's kernel image (which would pose logistical and policy problems), so Microsoft doesn't.

1
  • Thanks for your answer, but I already did these steps, it's in the link to the github issue in the original post. As the error shows, docker tries to use iptables-legacy, but returns this error : failed to start daemon: Error initializing network controller: error obtaining controller instance: failed to register "bridge" driver: failed to create NAT chain DOCKER: iptables failed: iptables -t nat -N DOCKER: iptables v1.8.7 (legacy): can't initialize iptables table `nat': Table does not exist (do you need to insmod?) Perhaps iptables or your kernel needs to be upgraded. (exit status 3)
    – Genku
    Jan 26 at 22:26
0

I followed this post, which says to launch ubuntu.exe as administrator and that will fix the issue.

What this does is reinstall a distro, and iptables worked there. Still didn't work on the first distro I installed previously. But it works fine on this newly installed distro so I considered it fixed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .