0
点赞
收藏
分享

微信扫一扫

Centos7安装Docker后无法启动:Failed to program NAT chain: INVALID_ZONE: docker


现象

安装Docker官方给出的文档进行安装,都没有什么问题:

直到我执行​​sudo systemctl start docker​​时,

报错:
​​​Job for docker.service failed because the control process exited with error code. See "systemctl status docker.service" and "journalctl -xe" for details. ​

接着我执行​​systemctl status docker.service​​结果如下图所示:

Centos7安装Docker后无法启动:Failed to program NAT chain: INVALID_ZONE: docker_Docker


说实话,上述基本上没看出来是因为什么导致的:接着执行​​dockerd​

Centos7安装Docker后无法启动:Failed to program NAT chain: INVALID_ZONE: docker_docker_02


最后一句话

​failed to start daemon: Error initializing network controller: Error creating default "bridge" network: Failed to program NAT chain: INVALID_ZONE: docker​

是比较明显的错误信息

问题

这是由于​​firewalld​​​与​​docker​​​冲突的问题,从本质上来说,应该是​​firewalld​​​与​​iptables​​的冲突,

来自Docker文档

On Linux, Docker manipulates iptables rules to provide network isolation.
While this is an implementation detail
and you should not modify the rules Docker inserts into your iptables policies,

Centos7安装Docker后无法启动:Failed to program NAT chain: INVALID_ZONE: docker_Docker_03


链接:https://docs.docker.com/network/iptables/#integration-with-firewalld

具体的我还没搞懂,先挖个坑吧!

解决方案

方法一:
官网的那种方法我试了,没有效果,不过关闭​​​firewalld​​这个方法是有效的:

```
systemctl stop firewalld
systemctl disable firewalld
```

方法二(更新):
在Centos上安装Docker对linux版本有要求,最新的Docker不支持老版本的CentOS。
我的大概是7.4x,升级后可以启动!

sudo yum -y update

方法三:

方法来源:Stackoverflow
​ https://stackoverflow.com/questions/65213831/failed-to-start-daemon-error-initializing-network-controller-error-creating-de​​

$ firewall-cmd --get-active-zones
FedoraWorkstation
interfaces: ens4u1u2 wlp59s0
docker
interfaces: br-48d7d996793a
libvirt
interfaces: virbr0
trusted
interfaces: docker0

the interface docker0 seems to be in the trusted zone. But there’s another zone called docker.

So I decided to give it a shot and add it to the docker zone instead.

$ sudo firewall-cmd --permanent --zone=docker --change-interface=docker0
$ sudo firewall-cmd --reload

Looks like this afterwards:

$ firewall-cmd --get-active-zones
FedoraWorkstation
interfaces: ens4u1u2 wlp59s0
docker
interfaces: br-48d7d996793a docker0
libvirt
interfaces: virbr0

Seems to work.
Maybe someone can shed more light on this.
Edit: added ​​​firewall-cmd --reload​​ as pointed out in the comments


举报

相关推荐

0 条评论