From 0ee4643d4ac503665424c7bf531d9523503b5a93 Mon Sep 17 00:00:00 2001 From: silverwind Date: Fri, 3 Jul 2026 08:23:12 +0000 Subject: [PATCH] fix: install `nftables` in dind images to silence `nft` cleanup errors (#1064) Fixes: https://gitea.com/gitea/runner/issues/1061 Related: https://github.com/moby/moby/pull/52886 Docker 29.6.0 changed `dockerd` to shell out to the external `nft` binary for firewall-rule cleanup instead of linking `libnftables` (release note: *"Mitigate a crash in libnftables when using nftables as the firewall backend by changing the default build option to execute the `nft` command instead."*). The upstream `docker:dind` image only ships `iptables`/`ip6tables`, so `dockerd` logs `failed to find nft tool` on startup and shutdown. Networking is unaffected (default firewall backend is still iptables), but the errors are noisy. Install `nftables` in both dind variants to provide the binary. *PR authored by Claude (Opus 4.8).*Reviewed-on: https://gitea.com/gitea/runner/pulls/1064 Reviewed-by: Lunny Xiao Co-authored-by: silverwind --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 940c5fd1..6a0acb1e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -24,7 +24,7 @@ ARG VERSION=dev LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner" LABEL org.opencontainers.image.version="${VERSION}" -RUN apk add --no-cache s6 bash git tzdata +RUN apk add --no-cache s6 bash git tzdata nftables COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner COPY scripts/run.sh /usr/local/bin/run.sh @@ -45,7 +45,7 @@ LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner" LABEL org.opencontainers.image.version="${VERSION}" USER root -RUN apk add --no-cache s6 bash git tzdata +RUN apk add --no-cache s6 bash git tzdata nftables COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner COPY scripts/run.sh /usr/local/bin/run.sh