From 8b39d3fdc7fbd022c6d0996ec35f36aa504a5f7b Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Sun, 31 Aug 2025 13:52:03 +0200 Subject: [PATCH] confd: explicitly declare cni backends - the port-mapping plugin supports iptables or nftables - the firewall plugin support only iptables or firewalld Enforce use of iptables wrapper for nftables, for now, in both plugins. This all needs to be refactored to run podman with "unmanaged" networks in the future. Related to issue #1125 Signed-off-by: Joachim Wiberg --- src/confd/src/cni.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/confd/src/cni.c b/src/confd/src/cni.c index 701b1a4c..436a43fc 100644 --- a/src/confd/src/cni.c +++ b/src/confd/src/cni.c @@ -250,12 +250,15 @@ static int cni_bridge(struct lyd_node *net, const char *ifname) " },\n" /* /bridge */ " {\n" " \"type\": \"portmap\",\n" + " \"backend\": \"iptables\",\n" + " \"snat\": true,\n" " \"capabilities\": {\n" " \"portMappings\": true\n" " }\n" " },\n" /* /portmap */ " {\n" - " \"type\": \"firewall\"\n" + " \"type\": \"firewall\",\n" + " \"backend\": \"iptables\"\n" " },\n" /* /firewall */ " {\n" " \"type\": \"tuning\"\n"