Changes/NetavarkNftablesDefault

Netavark Nftables Default

Summary

Netavark should use nftables by default to create/manage the firewall rules for the Podman containers.

Owner

• Name: Paul Holzinger (luap99)
• Email: <pholzing@redhat.com>
• Name: Matthew Heon (mheon)
• Email: <mheon@redhat.com>

Current status

• Targeted release: Fedora Linux 41
• Last updated: 2024-11-08
• Announced
• Discussion thread
• FESCo issue: #3253
• Tracker bug: #2304176
• Release notes tracker: #121

Detailed Description

Netavark is used by Podman to configure networking for the containers. It manages interfaces and firewall rules. Currently it uses iptables by default to create the firewall rules for the containers but it can also be configured to use nftables (nft). The goal is to switch the default over to nftables. We also expect a small speed up for the container start-up times as nftables allows us to batch insert rules at once which makes it more performant and robust compared to iptables.

Benefit to Fedora

• netavark no longer requires iptables
• all rules are now part of the netavark table so there are less conflicts with other tools/users who manage firewall rules
• slightly faster container start-up time

Scope

• Proposal owners: Paul Holzinger, Matthew Heon
  • Using nftables is already supported in netavark as of version v1.10 (already included in fedora). Set a build option in the specfile to change the default driver from iptables to nftables

• Other developers: N/A

• Release engineering: N/A

• Policies and guidelines: N/A (not needed for this Change)

• Trademark approval: N/A (not needed for this Change)

• Alignment with the Fedora Strategy:

Upgrade/compatibility impact

Existing containers will automatically use the new firewall driver on the next start/stop, they will not have to be recreated.

One problem that can happen is if there are running containers before the update and then it switches to use the new nftables driver it will leak the old iptables rules and not clear them up. So in this case a manually cleanup might be needed (reboot clears it as well). Given that the dnf system-upgrade requires a reboot anyway it is not something users need to worry about (except maybe on rawhide).

Early Testing (Optional)

Do you require 'QA Blueprint' support? N

How To Test

The change can be tested by setting the firewall driver to nftables in containers.conf:

$ sudo mkdir -p /etc/containers/containers.conf.d
$ echo $'[network]\nfirewall_driver="nftables"' | sudo tee /etc/containers/containers.conf.d/50-netavark-nftables.conf

Changing the firewall driver while you have running containers will likely cause some conflicting rules so it is best to reboot when this option is changed.

Now start the containers and make sure the network works as usual. The rules can be checked with

$ sudo nft list table inet netavark

Known Issue with docker

When using both rootful podman and docker together the podman containers will not have external network connectivity. This is because docker adds a iptables rule to block all forwarding. https://docs.docker.com/network/packet-filtering-firewalls/#docker-on-a-router

Users either need to add a iptables rule to allow the podman traffic or revert to iptables driver via the containers.conf file option shown under "How To Test" above.

User Experience

There should no change in behavior for end users unless they manually messed with the netavark firewall rules.

Dependencies

N/A

Contingency Plan

• Contingency mechanism: Keep using iptables as default.
• Contingency deadline: beta freeze
• Blocks release? N/A

Documentation

N/A (not a System Wide Change)