vrr/wirenboard-agent-vm
2
0
Fork 0
mirror of https://github.com/wirenboard/agent-vm.git synced 2026-07-09 16:00:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

libkrunfw: enable nf_tables backend (iptables-nft / NFT_*)

Browse source 
The previous hunk gave us the iptables-legacy backend, which works
but only after `update-alternatives --set iptables iptables-legacy`
— debian 13 (the base image we ship) defaults `iptables` to
`iptables-nft`. Without `NF_TABLES` + the `NFT_*` family, the
default debian iptables binary errors with
`Failed to initialize nft: Protocol not supported` on every rule.
`NFT_COMPAT` lets the xtables-nft userspace translate
`-j MASQUERADE`-style rules into the corresponding native nft
expression so dockerd's rule set applies cleanly without forcing
the user to switch backends.

Verified in a nested guest: both `iptables` (nft default) and
`iptables-legacy` accept `-A POSTROUTING -j MASQUERADE`.

Cost on top of the netfilter hunk: +8 KB bzImage, +64 KB on the
shipped `.so` (one more 64K page). +3 ms nested boot, within noise.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
agent-vm 2026-05-26 20:51:04 +00:00
parent eadd712f06
commit 93a2aabcbf
2 changed files with 21 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
libkrunfw-overrides/README.md
View file

@ -24,6 +24,7 @@ Docker-in-Docker / nested KVM use cases, so we flip:
| `CONFIG_KVM=y` + `CONFIG_KVM_INTEL=y` + `CONFIG_KVM_AMD=y` | in-kernel KVM hypervisor for nested KVM use cases |
| `CONFIG_POSIX_MQUEUE=y` | runc/crun default OCI spec always mounts `/dev/mqueue`; without it every container start fails with `mount mqueue: no such device` |
| netfilter + bridge family (`NETFILTER`, `NF_CONNTRACK`, `NF_NAT`, `IP_NF_*`, `IP6_NF_*`, `BRIDGE`, `BRIDGE_NETFILTER`, `VLAN_8021Q`, …) | docker/podman `--network=bridge` (the default) needs iptables and the bridge driver to set up `docker0` + SNAT. Without these the daemon starts but every container start fails on `Table does not exist` |
| `nf_tables` family (`NF_TABLES`, `NFT_NAT`, `NFT_MASQ`, `NFT_CT`, `NFT_COMPAT`, …) | debian's default `iptables` alternative is `iptables-nft`, which talks to the kernel via nf_tables instead of ip_tables; without these the user has to flip `update-alternatives --set iptables iptables-legacy` first |
`olddefconfig` pulls in the rest of each cascade (`KVM_X86`, `KVM_SMM`,
`KVM_HYPERV`, `KVM_VFIO`, `POSIX_MQUEUE_SYSCTL`, `NETFILTER_NETLINK`,
@ -43,6 +44,8 @@ hunk added incrementally (Debian 13 toolchain, gcc 14.2.0). Boot time is
| baseline (just `+KVM`) | 7,431 KB | 21,300 KB | 1.015 s |
| `+POSIX_MQUEUE` | +12 KB | +64 KB (page padding) | +2 ms |
| `+netfilter + bridge` | +348 KB | +0 (still fits in mqueue's page) | +5 ms |
| `+nf_tables / NFT_*` | +8 KB | +64 KB (next page) | +3 ms |
| **all overrides** | **+368 KB (+5%)** | **+128 KB (+0.6%)** | **+10 ms (~1%)** |
The shipped `.so` is what affects npm-package size and `agent-vm setup` cold-pull
time; the `bzImage` figure is informational. Boot-time deltas were all within

19
libkrunfw-overrides/config-libkrunfw_x86_64.patch
View file

@ -18,7 +18,7 @@
CONFIG_AS_AVX512=y
CONFIG_AS_SHA1_NI=y
CONFIG_AS_SHA256_NI=y
@@ -2389,3 +2389,36 @@
@@ -2389,3 +2389,53 @@
#
# end of Rust hacking
# end of Kernel hacking
@ -55,3 +55,20 @@
+CONFIG_LLC=y
+CONFIG_STP=y
+CONFIG_VLAN_8021Q=y
+
+# nf_tables backend — debian's default `iptables` alternative is
+# `iptables-nft`, so without these the user has to manually
+# `update-alternatives --set iptables iptables-legacy` before
+# dockerd's iptables rules will apply. NFT_COMPAT lets the
+# xtables-nft userspace translate `-j MASQUERADE` into native nft.
+CONFIG_NF_TABLES=y
+CONFIG_NF_TABLES_INET=y
+CONFIG_NF_TABLES_IPV4=y
+CONFIG_NF_TABLES_IPV6=y
+CONFIG_NFT_NAT=y
+CONFIG_NFT_MASQ=y
+CONFIG_NFT_REDIR=y
+CONFIG_NFT_CT=y
+CONFIG_NFT_LOG=y
+CONFIG_NFT_LIMIT=y
+CONFIG_NFT_COMPAT=y