Ubuntu22.04下Docker启动失败（iptables相关）求助

问题描述 #

在Ubuntu 22.04上启动docker.service失败，状态显示Main process exited, code=exited, status=1/FAILURE。执行sudo systemctl status docker排查发现，Docker守护进程初始化网络控制器时创建默认bridge网络失败，核心报错是iptables执行NAT规则时提示：iptables v1.8.7 (nf_tables): Chain 'MASQUER' does not exist。

已尝试刷新iptables、重装iptables，参考相关方案未解决，怀疑与当前运行的OVPN服务器有关，寻求解决办法。

相关报错信息 #

systemctl status docker输出 #

sudo systemctl status docker
× docker.service - Docker Application Container Engine
     Loaded: loaded (/lib/systemd/system/docker.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Mon 2024-05-06 18:25:25 UTC; 6min ago
TriggeredBy: × docker.socket
       Docs: https://docs.docker.com
    Process: 1632897 ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock (code=exited, status=1/FAILURE)
   Main PID: 1632897 (code=exited, status=1/FAILURE)

May 06 18:25:22 server systemd[1]: docker.service: Main process exited, code=exited, status=1/FAILURE
May 06 18:25:22 server systemd[1]: docker.service: Failed with result 'exit-code'.
May 06 18:25:22 server systemd[1]: Failed to start Docker Application Container Engine.
May 06 18:25:25 server systemd[1]: docker.service: Scheduled restart job, restart counter is at 3.
May 06 18:25:25 server systemd[1]: Stopped Docker Application Container Engine.
May 06 18:25:25 server systemd[1]: docker.service: Start request repeated too quickly.
May 06 18:25:25 server systemd[1]: docker.service: Failed with result 'exit-code'.
May 06 18:25:25 server systemd[1]: Failed to start Docker Application Container Engine.

May 06 18:25:22 server systemd[1]: Starting Docker Application Container Engine...
░░ Subject: A start job for unit docker.service has begun execution
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit docker.service has begun execution.
░░
░░ The job identifier is 3281362.
May 06 18:25:22 server dockerd[1632897]: time="2024-05-06T18:25:22.186308133Z" level=info msg="Starting up"
May 06 18:25:22 server dockerd[1632897]: time="2024-05-06T18:25:22.190370332Z" level=info msg="detected 127.0.0.53 nameserver, assuming systemd-resolved, so using resolv.conf: /run/systemd/resolve/resolv.conf"
May 06 18:25:22 server dockerd[1632897]: time="2024-05-06T18:25:22.292233833Z" level=info msg="[graphdriver] using prior storage driver: overlay2"
May 06 18:25:22 server dockerd[1632897]: time="2024-05-06T18:25:22.292729359Z" level=info msg="Loading containers: start."
May 06 18:25:22 server dockerd[1632897]: time="2024-05-06T18:25:22.884221906Z" level=info msg="Default bridge (docker0) is assigned with an IP address 172.17.0.0/16. Daemon option --bip can be used to set a preferred IP address"
May 06 18:25:22 server dockerd[1632897]: failed to start daemon: Error initializing network controller: error creating default "bridge" network: Failed to Setup IP tables: Unable to enable NAT rule:  (iptables failed: iptables --wait -t nat -I POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUER>
May 06 18:25:22 server dockerd[1632897]:  (exit status 4))
May 06 18:25:22 server systemd[1]: docker.service: Main process exited, code=exited, status=1/FAILURE
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ An ExecStart= process belonging to unit docker.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 1.
May 06 18:25:22 server systemd[1]: docker.service: Failed with result 'exit-code'.

手动执行iptables命令的报错 #

sudo iptables --wait -t nat -I POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUER
iptables v1.8.7 (nf_tables): Chain 'MASQUER' does not exist
Try `iptables -h' or 'iptables --help' for more information

解决方法 #

1. 修复iptables链名称拼写问题 #

报错中的链名MASQUER是错误的，正确链名为MASQUERADE，大概率是Docker生成规则时出现截断或配置错误。先手动执行正确的规则测试：

sudo iptables --wait -t nat -I POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE

如果命令执行成功，说明是Docker规则拼写问题，可通过修改Docker daemon配置文件（/etc/docker/daemon.json）自定义网络规则，或重置Docker网络配置。

2. 切换iptables后端为legacy模式 #

Ubuntu 22.04默认用nf_tables作为iptables后端，部分场景下会和Docker、OVPN存在兼容性冲突。切换到legacy模式：

sudo update-alternatives --set iptables /usr/sbin/iptables-legacy
sudo update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy

切换完成后重启Docker：

sudo systemctl restart docker

3. 排查OVPN对iptables的影响 #

OVPN服务器会修改iptables规则，可能清空或篡改了nat表中的链。先临时停止OVPN服务，再尝试启动Docker：

sudo systemctl stop openvpn
sudo systemctl start docker

如果Docker能正常启动，说明OVPN规则与Docker冲突，需要修改OVPN配置，避免删除或干扰MASQUERADE链，或在OVPN启动脚本中保留Docker所需的iptables规则。

4. 重建Docker默认网络 #

若以上方法无效，可删除Docker默认bridge网络后重建：

sudo systemctl stop docker
sudo ip link set docker0 down
sudo brctl delbr docker0
sudo systemctl start docker

（若缺少brctl工具，先安装：sudo apt install bridge-utils）

内容的提问来源于stack exchange，提问作者DMX