Add docker config fragment #47
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ricardosalveti
approved these changes
May 19, 2025
|
I manually built this and ran check-config again: Which looks good (CONFIG_MEMCG_SWAP being obsolete). Unfortunately, docker doesn't run: Indeed: Which is due to netlink for netfilter being missing: I believe this is provided by linux/net/netfilter/nfnetlink.c which is enabled by CONFIG_NETFILTER_NETLINK=m but that's typically not enabled directly, instead Debian kernels set: I'm not sure which of these docker needs, perhaps only CONFIG_NETFILTER_NETLINK, perhaps CONFIG_NETFILTER_NETLINK_ACCT to have some stats on network traffic from containers. I've turn them all as modules in the docker config fragment, but now I get: This is because iptables in Debian is built for nftables, so CONFIG_NF_TABLES is needed (it's =m in the Debian kernel). After this change, iptables -L works, but docker still fails to start with: and indeed, this fails: but I have yet to figure out what's missing in the kernel for this to work. |
Ran Moby's check-config script against a mainline + defconfig kernel and followed Debian's existing configs as much as possible. Will need to maintain and update from time to time. Signed-off-by: Loïc Minier <[email protected]>
Signed-off-by: Loïc Minier <[email protected]>
Signed-off-by: Loïc Minier <[email protected]>
lool
force-pushed
the
docker-kernel-configs
branch
from
b3ea50a to
a36ec34
Compare
|
I checked configs from LmP starting with these: all were already set either as =m or =y except for CONFIG_DM_THIN_PROVISIONING which seems unrelated to these issues and CONFIG_CFQ_GROUP_IOSCHED which seems to be an obsolete config (dropped in 4.20). I'll check https://github.com/foundriesio/lmp-kernel-cache/blob/c6f25306a02f3bfd7a4c140f0f347402f6a72ee6/features/netfilter/netfilter.cfg next. |
|
and these were the missing configs: I'll add a netfilter config fragment based on the Yocto one; I haven't figured proper copyright/licensing attribution for it yet though. |
|
Even after these additions, I still get: |
Based on LmP's. Signed-off-by: Loïc Minier <[email protected]>
Signed-off-by: Loïc Minier <[email protected]>
Signed-off-by: Loïc Minier <[email protected]>
This was referenced Jun 25, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add and use docker config fragment
Fixes #43