Request 1206063 (superseded)

This request is superseded by request 1216681 (Show diff)

Overview

Request 1206063 superseded

No description set

Created by dancermak 15 days ago
In state superseded
Superseded by 1216681

Submit podman

Comments for request 1206063 6

Marcus Rueckert (darix) - 15 days ago

reviewer

that ipv6 change seems wrong.

shouldnt this change be in the netavark package and not in podman? podman can be run with other CNIs too no?

Dan Čermák (dancermak) - 15 days ago

author source maintainer

No, CNI support has been deprecated & disabled with podman 5.0

Marcus Rueckert (darix) - 15 days ago

reviewer

well even then ... it is not podman which needs this module but netavark.

Danish Prakash (danishprakash) - 14 days ago

source maintainer

Podman and netavark both need this module to be loaded, for rootless and rootfull networking respectively. Adding it to netavark, even though technically correct, would be redundant because netavark is only consumed by podman.

Marcus Rueckert (darix) - 13 days ago

reviewer

actually a further discussion brought up a few more interesting points

firewalld which is our default firewall solution is using nftables now by default
the module you try to load there isnt actually used by nftables but by iptables.
based on https://github.com/containers/netavark/pull/883 it looks like netavark could natively support nftables?

i just had the "fun" of debugging a machine where the main firewall was nftables, but docker in that case was still using iptables. for proper distro integration it would be better if we ensured that podman and netavark are using nftables as well. or at least us the iptables nft backend.

Danish Prakash (danishprakash) - 13 days ago

source maintainer

Contd. https://bugzilla.opensuse.org/show_bug.cgi?id=1231424