Fix: Docker service fails to start on AlmaLinux 10.2 (cloud image)

Support
1

After installing Docker CE on a fresh AlmaLinux 10.2 from a cloud-init image (both GenericCloud-10.2-20260526.0.x86_64_v2.qcow2 and GenericCloud-10.2-20260526.0.x86_64.qcow2) docker.service fails to start. journalctl -u docker shows message:
failed to start daemon: Error initializing network controller: error obtaining controller instance: failed to register “bridge” driver: failed to add jump rules to ipv4 NAT table: failed to append jump rules to nat-PREROUTING: (iptables failed: iptables --wait -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER: iptables v1.8.11 (nf_tables): RULE_APPEND failed (No such file or directory): rule in chain PREROUTING (exit status 4))

AlmaLinux 10 minimal and cloud images ship a stripped-down kernel package:

  • Several netfilter kernel modules that Docker’s bridge driver depends on - notably br_netfilter and ip_tables - are not included in the base kernel package. They live in a separate package, kernel-modules-extra, which isn’t installed by default on minimal images.
  • Because these modules aren’t loaded, dockerd can’t set up the nftables/iptables rules it needs for its bridge network, and it fails to start with the error above.

Fix which helped me resolve this issue was to install the missing extra kernel modules package:
sudo dnf install -y kernel-modules-extra
Then just restart Docker service and you should be fine.

Wrapped my head around this one for a while, so thought it is worth sharing here. Hope it helps. :slight_smile:

2 Likes
2

This is because RHEL upstream got the package wrong. Normally, it should include the kernel-modules-extra package, but due to recent changes, a whole set of debug packages were introduced instead. If you are currently using a system installed with the latest boot image, you can check it with `rpm -qa | grep kernel`. If there are any debug-related kernels, then this is the bug I mentioned. It is also not recommended to continue using this system. I have merged the feedback from upstream, and the maintainer has taken over this issue. You can wait patiently for the fix. Sorry my English is not good, I used a translation software.

1 Like