docker容器start提示：-i docker0: iptables: No chain/target/match by that name

Posted on Views:

问题

docker拉起容器提示iptable链无法创建（核查对应iptable内核模块是否加载？）

env

  • centos7

f8f90520e0ecc922a3b4a234e1376e10.png

解决

1.查看docker日志

jounalctl -u docker -f

Nov 04 21:50:50 online_crawler_db dockerd[16506]: time="2025-11-04T21:50:50.069936486+08:00" level=warning msg="Failed to allocate and map port 6106-6106:  (iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 6106 -j DNAT --to-destination 172.17.0.2:8081 ! -i docker0: iptables: No chain/target/match by that name.\n (exit status 1))"
Nov 04 21:50:50 online_crawler_db dockerd[16506]: time="2025-11-04T21:50:50.121406678+08:00" level=error msg="Handler for POST /v1.43/containers/nexus/start returned error: driver failed programming external connectivity on endpoint nexus (059317a6f464be15f338a7056b4898fb0c3739565ed50b58f98b6d40566640f0):  (iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 6106 -j DNAT --to-destination 172.17.0.2:8081 ! -i docker0: iptables: No chain/target/match by that name.\n (exit status 1))"
Nov 04 21:55:12 online_crawler_db dockerd[16506]: time="2025-11-04T21:55:12.129412654+08:00" level=warning msg="Failed to allocate and map port 6106-6106:  (iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 6106 -j DNAT --to-destination 172.17.0.2:8081 ! -i docker0: iptables: No chain/target/match by that name.\n (exit status 1))"

2.检查iptable内核模块

# 2.1临时安装模块
modprobe br_netfilter
modprobe ip_tables
modprobe xt_nat

# 2.2lsmod
$ lsmod | grep -E 'br_netfilter|ip_tables|xt_nat'
xt_nat                 12681  8 
br_netfilter           22256  0 
nf_nat                 26583  3 nf_nat_ipv4,xt_nat,nf_nat_masquerade_ipv4
bridge                155432  1 br_netfilter
ip_tables              27126  3 iptable_filter,iptable_mangle,iptable_nat
root@online_crawler_db[Tue Nov 04  21:58:14]:

# 2.3支持开机自启动模块
$ cat  /etc/modules-load.d/docker-net.conf
br_netfilter
ip_tables
xt_nat

# 2.4重新启动 systemd-modules-load 服务
systemctl restart systemd-modules-load

重新启动 Docker 服务
systemctl restart docker

# 2.5查看docker链
root@online_crawler_db[Tue Nov 04  21:58:26]:~
$ iptables -t nat -L -n | grep DOCKER
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
DOCKER     all  --  0.0.0.0/0           !127.0.0.0/8          ADDRTYPE match dst-type LOCAL
Chain DOCKER (2 references)
You have mail in /var/spool/mail/root