iptables listing is empty on debian9 & debian10

[vmassol]

Hi there,

Thanks a lot for your nice and handy docker images. We're using the iptables one and it works fine on several machines but on some others we get empty iptables listed (which doesn't correspond to the reality and differs from running iptables -S directly on the host):

$ docker run --privileged --cap-add=NET_ADMIN --network=host --rm --entrypoint "/bin/sh" vimagick/iptables -c "/sbin/iptables -S"
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT

Would you have any idea what could be wrong?

Thanks a lot and thanks again for your work!

[vmassol]

FTR seems it works on debian8 but fails on debian9. Not sure why yet.

[vmassol]

Note that nftables is replacing iptables in debian 10 and thus this image is not working on debian 10 (not sure why it's also not working on debian9 though).

$ sudo docker run --cap-add=NET_ADMIN --network=host --rm --entrypoint "/bin/sh" vimagick/iptables -c "/sbin/iptables --version"
iptables v1.8.7 (legacy)

Whereas on the host:

$ sudo iptables --version
iptables v1.8.2 (nf_tables)

[vmassol]

Actually it works on debian10 with:

docker run --cap-add=NET_ADMIN --network=host --rm --entrypoint "/bin/sh" vimagick/iptables -c "/sbin/iptables-nft -S"

:)