@@ -45,13 +45,22 @@ func setupIPv6BridgeNetFiltering(config *networkConfiguration, _ *bridgeInterfac
4545 return nil
4646}
4747
48+ func loadBridgeNetFilterModule (fullPath string ) error {
49+ // br_netfilter implictly loads bridge module upon modprobe
50+ modName := "br_netfilter"
51+ if _ , err := os .Stat (fullPath ); err != nil {
52+ if out , err := exec .Command ("modprobe" , "-va" , modName ).CombinedOutput (); err != nil {
53+ log .G (context .TODO ()).WithError (err ).Errorf ("Running modprobe %s failed with message: %s" , modName , out )
54+ return fmt .Errorf ("cannot restrict inter-container communication: modprobe %s failed: %w" , modName , err )
55+ }
56+ }
57+ return nil
58+ }
59+
4860// Enable bridge net filtering if not already enabled. See GitHub issue #11404
4961func enableBridgeNetFiltering (nfParam string ) error {
50- if _ , err := os .Stat ("/proc/sys/net/bridge" ); err != nil {
51- if out , err := exec .Command ("modprobe" , "-va" , "bridge" , "br_netfilter" ).CombinedOutput (); err != nil {
52- log .G (context .TODO ()).WithError (err ).Errorf ("Running modprobe bridge br_netfilter failed with message: %s" , out )
53- return fmt .Errorf ("cannot restrict inter-container communication: modprobe br_netfilter failed: %w" , err )
54- }
62+ if err := loadBridgeNetFilterModule (nfParam ); err != nil {
63+ return fmt .Errorf ("loadBridgeNetFilterModule failed: %s" , err )
5564 }
5665 enabled , err := getKernelBoolParam (nfParam )
5766 if err != nil {
0 commit comments