Issues with recent version of Docker

[SchoolGuy]

Bug Report

Description

Since Docker 28.0.0 there are more kernel modules needed to run Docker.

See: moby/moby#49557 & https://github.com/moby/moby/releases/tag/v28.0.2

Expected Behavior

Docker is able to run a container successfully.

Current Behavior

Docker reports that there is a missing kernel module.

Possible Solution

Build the image with the iptables_raw module enabled per-default.

Steps to Reproduce (for bugs)

1. Execute Ubuntu 22.04 Image
2. Execute Docker container
3. See issue

Your Environment

• Image: ghcr.io/hostinger/fireactions-images/ubuntu22.04:latest

[SchoolGuy]

Hm... Example CI run is https://github.com/cobbler/cobbler/actions/runs/16174614307/job/45912574353.

However, if I locally start the container, then the module is available and loaded:

root@e79bebbfbfc6:/# lsmod | grep iptable_raw
iptable_raw            12288  0

[SchoolGuy]

Okay so the situation get's funnyier:

root@localhost:~# docker pull registry.opensuse.org/systemsmanagement/cobbler/github-ci/containers/cobbler-test-github:main
main: Pulling from systemsmanagement/cobbler/github-ci/containers/cobbler-test-github
0a22199247e7: Already exists 
d00714cc523f: Pull complete 
Digest: sha256:af23ee6a0da12111b8f7030dc68b467685eab6bdefe8aedf95b0acebc672cdaa
Status: Downloaded newer image for registry.opensuse.org/systemsmanagement/cobbler/github-ci/containers/cobbler-test-github:main
registry.opensuse.org/systemsmanagement/cobbler/github-ci/containers/cobbler-test-github:main
root@localhost:~# lsmod
Module                  Size  Used by
root@localhost:~# iConnection to 192.168.128.11 closed by remote host.

On the host side I am getting suspicious messages in the journal:

Jul 14 11:47:25 laurel2 kernel: Buffer I/O error on dev dm-4, logical block 7864304, async page read

Edit: As buffer I/O errors are regularly bad drives, I have run badblocks without any sign of real bad blocks.

[SchoolGuy]

Adding

[Service]
Environment="DOCKER_INSECURE_NO_IPTABLES_RAW=1"

to the systemd override for Docker fixes the issue.