Why I get "WARN iptables check error: exit status 111. Output:" when I launch containerlab without sudo?

[stephane-klein]

Hello,

When I launch containerlab with my non-root user, I get this warning message: WARN iptables check error: exit status 111. Output:.
Here is the complete output of the command:

$ containerlab -t network-a.clab.yaml deploy -c
15:52:56 INFO Containerlab started version=0.69.3
15:52:56 INFO Parsing & checking topology file=network-a.clab.yaml
15:52:57 INFO Destroying lab name=network-a
15:52:57 INFO Removed container name=clab-network-a-vm-a2
15:52:57 INFO Removed container name=clab-network-a-vm-a3
15:52:57 INFO Removed container name=clab-network-a-vm-a1
15:52:57 INFO Removing host entries path=/etc/hosts
15:52:57 INFO Removing SSH config path=/etc/ssh/ssh_config.d/clab-network-a.conf
15:52:57 INFO Removing directory path=/home/stephane/git/github.com/stephane-klein/containerlab-playground/clab-network-a
15:52:57 WARN iptables check error: exit status 111. Output:
15:52:57 WARN iptables check error: exit status 111. Output:
15:52:57 WARN iptables check error: exit status 111. Output:
15:52:57 WARN iptables check error: exit status 111. Output:
15:52:57 INFO Creating lab directory path=/home/stephane/git/github.com/stephane-klein/containerlab-playground/clab-network-a
15:52:57 INFO Creating container name=vm-a1
15:52:57 INFO Creating container name=vm-a3
15:52:57 INFO Creating container name=vm-a2
15:52:57 INFO Adding host entries path=/etc/hosts
15:52:57 INFO Adding SSH config for nodes path=/etc/ssh/ssh_config.d/clab-network-a.conf
You are on the latest version (0.69.3)
╭──────────────────────┬───────────────────┬─────────┬─────────────────╮
│         Name         │     Kind/Image    │  State  │  IPv4/6 Address │
├──────────────────────┼───────────────────┼─────────┼─────────────────┤
│ clab-network-a-vm-a1 │ linux             │ running │ 172.18.0.2      │
│                      │ mitchv85/ohv-host │         │ 2001:db8:a:1::2 │
├──────────────────────┼───────────────────┼─────────┼─────────────────┤
│ clab-network-a-vm-a2 │ linux             │ running │ 172.18.0.3      │
│                      │ mitchv85/ohv-host │         │ 2001:db8:a:1::3 │
├──────────────────────┼───────────────────┼─────────┼─────────────────┤
│ clab-network-a-vm-a3 │ linux             │ running │ 172.18.0.4      │
│                      │ mitchv85/ohv-host │         │ 2001:db8:a:1::4 │
╰──────────────────────┴───────────────────┴─────────┴─────────────────╯

I do not get a warning message when I run the command with sudo:

$ sudo containerlab -t network-a.clab.yaml deploy -c
Placez votre index droit sur le lecteur d’empreintes
15:55:30 INFO Containerlab started version=0.69.3
15:55:30 INFO Parsing & checking topology file=network-a.clab.yaml
15:55:30 INFO Destroying lab name=network-a
15:55:30 INFO Removed container name=clab-network-a-vm-a1
15:55:30 INFO Removed container name=clab-network-a-vm-a3
15:55:30 INFO Removed container name=clab-network-a-vm-a2
15:55:30 INFO Removing host entries path=/etc/hosts
15:55:30 INFO Removing SSH config path=/etc/ssh/ssh_config.d/clab-network-a.conf
15:55:30 INFO Removing directory path=/home/stephane/git/github.com/stephane-klein/containerlab-playground/clab-network-a
15:55:31 INFO Creating lab directory path=/home/stephane/git/github.com/stephane-klein/containerlab-playground/clab-network-a
15:55:31 INFO Creating container name=vm-a1
15:55:31 INFO Creating container name=vm-a2
15:55:31 INFO Creating container name=vm-a3
15:55:31 INFO Adding host entries path=/etc/hosts
15:55:31 INFO Adding SSH config for nodes path=/etc/ssh/ssh_config.d/clab-network-a.conf
You are on the latest version (0.69.3)
╭──────────────────────┬───────────────────┬─────────┬─────────────────╮
│         Name         │     Kind/Image    │  State  │  IPv4/6 Address │
├──────────────────────┼───────────────────┼─────────┼─────────────────┤
│ clab-network-a-vm-a1 │ linux             │ running │ 172.18.0.3      │
│                      │ mitchv85/ohv-host │         │ 2001:db8:a:1::2 │
├──────────────────────┼───────────────────┼─────────┼─────────────────┤
│ clab-network-a-vm-a2 │ linux             │ running │ 172.18.0.2      │
│                      │ mitchv85/ohv-host │         │ 2001:db8:a:1::3 │
├──────────────────────┼───────────────────┼─────────┼─────────────────┤
│ clab-network-a-vm-a3 │ linux             │ running │ 172.18.0.4      │
│                      │ mitchv85/ohv-host │         │ 2001:db8:a:1::4 │
╰──────────────────────┴───────────────────┴─────────┴─────────────────╯

Questions:

• Is this issue known?
• Is using sudo the recommended method for running containerlab?
• If not, what needs to be configured in Fedora to avoid this warning message?

Best regards,
Stéphane

[hellt]

Interesting

iptables will exit immediately with an error code of 111 if it finds that it was called as a setuid-to-root program. iptables cannot be used safely in this manner because it trusts the shared libraries (matches, targets) loaded at run time, the search path can be set using environment variables.

what OS, kernel and iptables version are you running?

[stephane-klein]

@hellt

$ neofetch --stdout
stephane@t14s
-------------
OS: Fedora Linux 42 (Workstation Edition) x86_64
Host: 21CQCTO1WW ThinkPad T14s Gen 3
Kernel: 6.16.4-200.fc42.x86_64
Uptime: 1 day, 6 hours, 3 mins
Packages: 3976 (rpm), 98 (flatpak)
Shell: zsh 5.9
Resolution: 3840x2160
DE: GNOME 48.4
WM: Mutter
WM Theme: Adwaita
Theme: Adwaita:dark [GTK2/3]
Icons: Adwaita [GTK2/3]
Terminal: tmux
CPU: AMD Ryzen 7 PRO 6850U with Radeon Graphics (16) @ 4.769GHz
GPU: AMD ATI Radeon 680M
Memory: 19839MiB / 30836MiB

$ iptables --version
iptables v1.8.11 (legacy)