Skip to content

docker-engine: add nftables dependencies #284

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
crazy-max merged 1 commit into from
Oct 6, 2025
Merged

docker-engine: add nftables dependencies #284

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions hack/scripts/rpm-builddep.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,10 @@

arch=$1
specsDir=$2
shift 2

if [[ -z "$arch" ]] || [[ -z "$specsDir" ]]; then
echo "usage: ./rpm-builddep <arch> <specs-dir>" >&2
echo "usage: ./rpm-builddep <arch> <specs-dir> [extra-args...]" >&2
exit 1
fi

Expand All @@ -35,4 +36,4 @@ else
fi

set -x
$builddepCmd -y "$specsDir"/*.spec
$builddepCmd "$@" -y "$specsDir"/*.spec
2 changes: 1 addition & 1 deletion hack/scripts/verify-rpm-init.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ case "$pkgrelease" in
dnf install -y findutils dnf-plugins-core oraclelinux-release-el9 oracle-epel-release-el9
dnf config-manager --enable ol9_addons ol9_codeready_builder
;;
fedora*)
fedora*|rhel*)
dnf install -y findutils dnf-plugins-core
;;
rockylinux8|almalinux8)
Expand Down
14 changes: 11 additions & 3 deletions pkg/docker-engine/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,8 +148,16 @@ RUN --mount=type=bind,from=scripts,source=rpm-init.sh,target=/usr/local/bin/rpm-
rpm-init $DISTRO_NAME
COPY rpm /root/rpmbuild/SPECS
ARG TARGETPLATFORM
RUN --mount=type=bind,from=scripts,source=rpm-builddep.sh,target=/usr/local/bin/rpm-builddep \
rpm-builddep $(xx-info rhel-arch) /root/rpmbuild/SPECS
RUN --mount=type=bind,from=scripts,source=rpm-builddep.sh,target=/usr/local/bin/rpm-builddep <<EOT
set -e
no_libnftables=0
case "$DISTRO_NAME" in
rhel*)
no_libnftables=1
Comment on lines +155 to +156
Copy link
Member

@thaJeztah thaJeztah Oct 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we should add a comment why we're skipping it on RHEL (was thinking that later), because RHEL supports it, but it currently requires a subscription to install the required dependencies.

(And, as a further follow-up, we could even consider adding a way to override this, so that it can be built if a subscription is in place)

Copy link
Member Author

@crazy-max crazy-max Oct 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added comment in https://github.com/docker/packaging/pull/284/files#diff-2eafab85eee78d035c1f1b46aec61fce6d76d11d3002428d91cf5d76eed8ee12R64-R67

;;
esac
rpm-builddep $(xx-info rhel-arch) /root/rpmbuild/SPECS --define "_no_libnftables ${no_libnftables}"
EOT
WORKDIR /root/rpmbuild
ARG NIGHTLY_BUILD
ARG DISTRO_RELEASE
Expand Down Expand Up @@ -196,7 +204,7 @@ ARG PKG_REF
ARG NIGHTLY_BUILD
WORKDIR /build
ARG TARGETPLATFORM
RUN xx-apt-get install -y gcc libc6-dev libapparmor-dev libsecret-1-dev libsystemd-dev libudev-dev pkg-config
RUN xx-apt-get install -y gcc libc6-dev libapparmor-dev libnftables-dev libsecret-1-dev libsystemd-dev libudev-dev pkg-config
RUN --mount=type=bind,source=scripts/pkg-static-build.sh,target=/usr/local/bin/pkg-static-build \
--mount=type=bind,source=scripts/check-gomod.sh,target=/usr/local/bin/check-gomod \
--mount=type=bind,from=scripts,source=gen-ver.sh,target=/usr/local/bin/gen-ver \
Expand Down
2 changes: 2 additions & 0 deletions pkg/docker-engine/deb/control
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ Build-Depends: ca-certificates,
debhelper-compat (= 12),
gcc,
libc-dev,
libnftables-dev,
libsystemd-dev,
libtool,
make,
Expand All @@ -22,6 +23,7 @@ Architecture: linux-any
Depends: containerd.io (>= 1.7.27),
docker-ce-cli,
iptables,
nftables,
${shlibs:Depends}
Recommends: apparmor,
ca-certificates,
Expand Down
4 changes: 4 additions & 0 deletions pkg/docker-engine/rpm/docker-ce.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ Recommends: docker-ce-rootless-extras
Requires: container-selinux
Requires: systemd
Requires: iptables
Requires: nftables
%if %{undefined rhel} || 0%{?rhel} < 9
# Libcgroup is no longer available in RHEL/CentOS >= 9 distros.
Requires: libcgroup
Expand All @@ -35,6 +36,9 @@ BuildRequires: gcc
BuildRequires: glibc-static
BuildRequires: libarchive
BuildRequires: libtool
%if 0%{?_no_libnftables} == 0
BuildRequires: nftables-devel
%endif
BuildRequires: make
BuildRequires: pkgconfig
BuildRequires: pkgconfig(systemd)
Expand Down
15 changes: 15 additions & 0 deletions pkg/docker-engine/scripts/pkg-rpm-build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,11 +58,23 @@ export GO111MODULE=$(check-gomod)
xx-go --wrap
fix-cc

no_libnftables=0
case "$DISTRO_NAME" in
rhel*)
# The nftables-devel package is only available in RHEL CRB. For now, build
# with tag "no_libnftables", so dockerd will exec the nft tool, and this
# package is not required. Note that this '--define' is also defined in
# the Dockerfile to install build dependencies.
no_libnftables=1
;;
esac

rpmDefine=(
--define "_version ${GENVER_PKG_VERSION}"
--define "_origversion ${GENVER_VERSION}"
--define "_release ${PKG_RPM_RELEASE:-${GENVER_RPM_RELEASE}}"
--define "_commit ${GENVER_COMMIT_SHORT}"
--define "_no_libnftables ${no_libnftables}"
)

pkgoutput="${OUTDIR}/${DISTRO_RELEASE}/${DISTRO_SUITE}/$(xx-info arch)"
Expand All @@ -75,6 +87,9 @@ case "$DISTRO_NAME" in
export DOCKER_BUILDTAGS="exclude_graphdriver_btrfs $DOCKER_BUILDTAGS"
;;
esac
if [ "$no_libnftables" -eq 1 ]; then
export DOCKER_BUILDTAGS="no_libnftables $DOCKER_BUILDTAGS"
fi

set -x

Expand Down
11 changes: 10 additions & 1 deletion pkg/docker-engine/verify.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ FROM scratch AS scripts
FROM ${DISTRO_IMAGE} AS base

FROM base AS verify-deb
RUN apt-get update && apt-get install -y libnftables1
COPY --from=xx / /
ARG DISTRO_RELEASE
ARG DISTRO_ID
Expand All @@ -48,7 +49,7 @@ RUN --mount=from=bin,target=/build <<EOT
(
set -x
dpkg-deb --info $package
dpkg -i --ignore-depends=containerd.io,docker-ce-cli,iptables --force-depends $package
dpkg -i --ignore-depends=containerd.io,docker-ce-cli,iptables,nftables --force-depends $package
)
done
set -x
Expand Down Expand Up @@ -82,6 +83,14 @@ RUN --mount=from=bin,target=/build <<EOT
rpm --install --nodeps $package
)
done
case "$DISTRO_NAME" in
rhel*)
;;
*)
# dockerd requires libnftables.so.1
dnf install -y nftables
;;
esac
set -x
dockerd --version
EOT
Expand Down