Unable to use nerdctl in rootless mode: iptables not found in $PATH despite installed

[sarunint]

Hi,

I somehow cannot run nerdctl in rootless mode. The error I got is:

sarunint@laptop:~> nerdctl run -it --rm alpine
docker.io/library/alpine:latest:                                                  resolved       |++++++++++++++++++++++++++++++++++++++| 
index-sha256:b95359c2505145f16c6aa384f9cc74eeff78eb36d308ca4fd902eeeb0a0b161b:    done           |++++++++++++++++++++++++++++++++++++++| 
manifest-sha256:3d426b0bfc361d6e8303f51459f17782b219dece42a1c7fe463b6014b189c86d: done           |++++++++++++++++++++++++++++++++++++++| 
config-sha256:bfe296a525011f7eb76075d688c681ca4feaad5afe3b142b36e30f1a171dc99a:   done           |++++++++++++++++++++++++++++++++++++++| 
layer-sha256:ca7dd9ec2225f2385955c43b2379305acd51543c28cf1d4e94522b3d94cce3ce:    done           |++++++++++++++++++++++++++++++++++++++| 
elapsed: 9.5 s                                                                    total:  2.7 Mi (288.8 KiB/s)                                     
FATA[0009] failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error running hook #0: error running hook: exit status 1, stdout: , stderr: time="2022-11-22T19:38:47+07:00" level=fatal msg="failed to call cni.Setup: plugin type=\"bridge\" failed (add): failed to locate iptables: exec: \"iptables\": executable file not found in $PATH"
Failed to write to log, write /home/sarunint/.local/share/nerdctl/1935db59/containers/default/2fa383a19e1cf99c4042d37920f48a423962d36a67df78b2491fb4c8d6aa612b/oci-hook.createRuntime.log: file already closed: unknown

The error mentioned \"iptables\": executable file not found in $PATH", so I checked my system. I have iptables installed, the full-path is /usr/sbin/iptables.

My system is running openSUSE Tumbleweed. nerdctl is installed from official openSUSE repository.

Any help would be appreciated!

Thanks.

[Zheaoli]

Which OpenSUSE version you used?

[sarunint]

openSUSE Tumbleweed, it is a rolling release distribution

[Zheaoli]

Have you ever setup the rootless mode by using script https://github.com/containerd/nerdctl/blob/main/extras/rootless/containerd-rootless.sh?

[sarunint]

I ran using the containerd-rootless-setuptool.sh install. Is that enough?

[LordGnomish]

Hi!

! I have the same issue here, did you solve this problem?

Best,

[LordGnomish]

I also use containerd-rootless-setuptool.sh install

[pedroscaff]

I had the same issue and in my system (debian bullseye) iptables and ip6tables was installed only under /usr/sbin. A quick fix was to make a link in /usr/local/bin:

• ln -s /usr/sbin/iptables /usr/local/bin/iptables
• ln -s /usr/sbin/ip6tables /usr/local/bin/ip6tables

[davidecavestro]

Same for Debian 12/Bookworm

[midnight-wonderer]

For those who want to stay true to the rootless spirit:

ln -s /usr/sbin/iptables ~/.local/bin/iptables
ln -s /usr/sbin/ip6tables ~/.local/bin/ip6tables

To the original asker (@sarunint)

• I am on Tumbleweed, too; the symlinks above work and require no root.
• My name is Sarun, too.

[zgfh]

this work for me （debain 12.2）

apt install iptables