RHEL 8.7 podman-compose error iptables

[7underlines]

sudo podman-compose up outputs this error:

WARN[0000] Failed to load cached network config: network ds_default not found in CNI cache, falling back to loading network ds_default from disk Error: unable to start container 80310f8a7682841891e9e09e43c982099548f8dfcc2bdef211a4fab7863b96e2: plugin type="firewall" failed (add): cni plugin fir ewall failed: failed to list iptables chains: running [/sbin/iptables -t filter -S --wait]: exit status 1: iptables v1.8.4 (nf_tables): table 'filter' is incompatible, use 'nft' tool.

OS: RHEL 8.7
podman iirc 4.2.0 (installed with sudo dnf install podman)
podman-compose (installed with sudo pip3 install podman-compose).
podman-plugins (installed with sudo dnf install podman-plugins)
SElinux disabled

It works on AlmaLinux 8.7 (same package versions) and Rocky Linux 8.7.

docker-comose.yml

version: '3.6'  
services:  
web:  
image: odoo:13.0  
depends_on:
 - db  
ports:
 - "8069:8069"  
db:  
image: postgres:13  
environment:  
- POSTGRES_DB=postgres  
- POSTGRES_PASSWORD=odoo  
- POSTGRES_USER=odoo 

I don't know if this is podman or RHEL specific.
https://www.reddit.com/r/redhat/comments/115mt09/rhel_87_error_iptables_table_filter_is/

containers/podman#5569

[bugfest]

Hi @thomaspeissl this is a cni issue not a podman-compose one. As you mention, most probably related with podman's CNI using iptables instead of nft in those new systems where the legacy iptables version has been faced out.

Some other mentions of similar issues:

• iptables error in AlmaLinux in WSL #469 (comment)
  • https://bugzilla.redhat.com/show_bug.cgi?id=1873474
• ERROR: table `nat' is incompatible, use 'nft' tool. containernetworking/plugins#461

iptables nft vs legacy:

• https://developers.redhat.com/blog/2020/08/18/iptables-the-two-variants-and-their-relationship-with-nftables#

I couldn't reproduce this issue in Rocky Linux 8.7; I don't have a subscription to RHEL so won't be able to help you there.

[7underlines]

Hi @bugfest

this is a cni issue not a podman-compose one

I was thinking about that too. So I opened this issue, but the maintainer says it's not a problem with his CNI plugin.
greenpau/cni-plugins#21

It feels like Podman says it's a CNI issue and CNI says it's a Podman issue 🤷‍♂️
I can only imagine that it is a quirk of RHEL 8.7.

[nycki93]

I had this problem on armbian v23.5.1 with podman v3.4.4. If I downgrade to podman-compose v1.0.3 it still gives a warning, but works fine. I can also create the network manually through podman. I only get the error with podman-compose, and only in v1.0.6.

edit: nevermind, I get this error whenever I create a network, even with compose v1.0.3. Downgrading to compose v0.1.11 resolves the issue.