{"action":"closed","issue":{"url":"https://api.github.com/repos/docker/docker/issues/14592","labels_url":"https://api.github.com/repos/docker/docker/issues/14592/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/14592/comments","events_url":"https://api.github.com/repos/docker/docker/issues/14592/events","html_url":"https://github.com/docker/docker/issues/14592","id":94742888,"number":14592,"title":"docker daemon fails silently due to incorrect iptables NAT kernel modules","user":{"login":"asridharan","id":3128730,"avatar_url":"https://avatars.githubusercontent.com/u/3128730?v=3","gravatar_id":"","url":"https://api.github.com/users/asridharan","html_url":"https://github.com/asridharan","followers_url":"https://api.github.com/users/asridharan/followers","following_url":"https://api.github.com/users/asridharan/following{/other_user}","gists_url":"https://api.github.com/users/asridharan/gists{/gist_id}","starred_url":"https://api.github.com/users/asridharan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/asridharan/subscriptions","organizations_url":"https://api.github.com/users/asridharan/orgs","repos_url":"https://api.github.com/users/asridharan/repos","events_url":"https://api.github.com/users/asridharan/events{/privacy}","received_events_url":"https://api.github.com/users/asridharan/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-07-13T15:07:06Z","updated_at":"2015-07-14T03:29:10Z","closed_at":"2015-07-14T03:29:10Z","body":"Description of problem:\r\nI am running docker daemon on Gentoo, on AWS. I am running Gentoo with a custom kernel. While configuring the kernel options looks like, by mistake, I had turned of the CONFIG_NF_NAT because of which the iptables_nat.ko module wouldn't load. Docker was failing to start cause when it launched the iptables -t NAT .... command iptables was failing and causing network connectivity issues to the instance on which it was running. \r\n\r\nI was able to figure out the problem by running docker in debug mode (docker -d --log-level=debug). However, I would expect docker to be able to log this failure in /var/log/docker.log, which would saved me a lot of time (initially I started suspecting there was a problem with the btrfs backend driver I was using).\r\n\r\n\r\nWhen starting docker daemon should dectect if iptable is NAT capable or not. \r\n\r\n\r\n`docker version`:\r\nClient version: 1.6.1\r\nClient API version: 1.18\r\nGo version (client): go1.4.2\r\nGit commit (client): 97cd073\r\nOS/Arch (client): linux/amd64\r\nServer version: 1.6.1\r\nServer API version: 1.18\r\nGo version (server): go1.4.2\r\nGit commit (server): 97cd073\r\nOS/Arch (server): linux/amd64\r\n\r\n`docker info`:\r\nContainers: 0\r\nImages: 0\r\nStorage Driver: devicemapper\r\n Pool Name: docker-202:1-924875-pool\r\n Pool Blocksize: 65.54 kB\r\n Backing Filesystem: extfs\r\n Data file: /dev/loop0\r\n Metadata file: /dev/loop1\r\n Data Space Used: 305.7 MB\r\n Data Space Total: 107.4 GB\r\n Data Space Available: 47.35 GB\r\n Metadata Space Used: 733.2 kB\r\n Metadata Space Total: 2.147 GB\r\n Metadata Space Available: 2.147 GB\r\n Udev Sync Supported: true\r\n Data loop file: /var/lib/docker/devicemapper/devicemapper/data\r\n Metadata loop file: /var/lib/docker/devicemapper/devicemapper/metadata\r\n Library Version: 1.02.88 (2014-08-05)\r\nExecution Driver: native-0.2\r\nKernel Version: 3.14.14-gentoo\r\nOperating System: Gentoo/Linux\r\nCPUs: 2\r\nTotal Memory: 3.68 GiB\r\nName: stitchnetos-aws\r\nID: BJM2:HBTR:HS2Y:CHUD:BMUV:BM26:GB7J:K2FV:4FRK:22JN:VWCF:3DBM\r\n\r\n`uname -a`:\r\nLinux stitchnetos-aws 3.14.14-gentoo #3 SMP Sun Jul 12 23:31:41 PDT 2015 x86_64 Intel(R) Xeon(R) CPU E5-2666 v3 @ 2.90GHz GenuineIntel GNU/Linux\r\n\r\nEnvironment details (AWS, VirtualBox, physical, etc.):\r\nCustom Gentoo EBS-backed AMI running on AWS. This is a PV-HVM AMI\r\n\r\nHow reproducible:\r\nShould be reproducible every time. \r\n\r\nSteps to Reproduce:\r\n1. Make sure that CONFIG_NF_NAT is turned off. This will lead to a missing nf_nat.ko module which in turn will not allow iptable_nat.ko to be loaded.\r\n2. Start docker. It will fail to start\r\n3. Check the /var/log/docker.log, there won't be any ERROR messages indicating something went wrong with docker. \r\n4. Try running docker in debug mode docker -d --log-level=debug and you should see docker going and getting stuck trying to install the NAT rules.\r\n\r\n\r\nActual Results:\r\nNo message in /var/log/docker.log\r\n\r\n\r\nExpected Results:\r\nExpect ERROR messages in /var/log/docker.log indicating the failures (or absence) of iptable NAT.  \r\n\r\nAdditional info:\r\nThe missing KERNEL config can be checked using the check_config.sh script, but in a production environment if there is a missing kernel module it might be harder to debug the issue, without apriori knowing that it is a problem with the kernel modules. Hence raising this issue to see if any checks and logs can be added to the docker daemon. \r\n"}}