如何解决Debian 11下Docker启动报错‘Failed to create NAT chain DOCKER’（重启无效）

操作系统 #

PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

Docker版本 #

Docker version 20.10.5+dfsg1, build 55c4c88

docker-compose版本 #

docker-compose version 1.25.3, build d4d1b42b

按官方文档安装Docker和docker-compose后，Docker无法启动。
执行systemctl status docker.service得到日志：

Mar 12 10:27:02 trigan4gb systemd[1]: docker.service: Scheduled restart job, restart counter is at 3.
Mar 12 10:27:02 trigan4gb systemd[1]: Stopped Docker Application Container Engine.
Mar 12 10:27:02 trigan4gb systemd[1]: docker.service: Start request repeated too quickly.
Mar 12 10:27:02 trigan4gb systemd[1]: docker.service: Failed with result 'exit-code'.
Mar 12 10:27:02 trigan4gb systemd[1]: Failed to start Docker Application Container Engine.

执行dockerd得到报错：

INFO[2023-03-12T10:32:11.180456435-04:00] stopping event stream following graceful shutdown  error="<nil>" module=libcontainerd namespace=moby
failed to start daemon: Error initializing network controller: error obtaining controller instance: failed to create NAT chain DOCKER: iptables failed: iptables -t nat -N DOCKER: iptables v1.8.7 (nf_tables): Could not fetch rule set generation id: Invalid argument

已尝试重启服务器，问题未解决。

该问题源于Debian 11默认采用nf_tables作为iptables后端，而Docker与该后端存在兼容性冲突，可按以下步骤修复：

1. 将iptables后端切换为legacy模式
   执行以下命令配置默认使用legacy版本的iptables：

   update-alternatives --set iptables /usr/sbin/iptables-legacy
   update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
   

2. 重启Docker服务

   systemctl restart docker
   

3. 验证Docker状态

   systemctl status docker
   

若上述操作后问题仍存在，可尝试清理Docker网络配置后重启：

• 停止Docker服务：

  systemctl stop docker
  

• 删除Docker网络相关文件：

  rm -rf /var/lib/docker/network
  

• 启动Docker服务：

  systemctl start docker
  

内容的提问来源于stack exchange，提问作者Chau Loi