Debian11安装docker-ce报错以及解决办法

农家者

安装docker时dpkg报错：


Setting up docker-ce (5:20.10.21~3-0~debian-bullseye) ...
Job for docker.service failed because the control process exited with error code.
See "systemctl status docker.service" and "journalctl -xe" for details.
invoke-rc.d: initscript docker, action "start" failed.
● docker.service - Docker Application Container Engine
     Loaded: loaded (/lib/systemd/system/docker.service; enabled; vendor preset: enabled)
     Active: activating (auto-restart) (Result: exit-code) since Sat 2022-11-26 10:52:13 EST; 7ms ago
TriggeredBy: ● docker.socket
       Docs: https://docs.docker.com
    Process: 1985 ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock (code=exited, status=1/FAILURE)
   Main PID: 1985 (code=exited, status=1/FAILURE)
        CPU: 69ms

Nov 26 10:52:13 LovableMindless-VM systemd[1]: docker.service: Main process exited, code=exited, status=1/FAILURE
Nov 26 10:52:13 LovableMindless-VM systemd[1]: docker.service: Failed with result 'exit-code'.
Nov 26 10:52:13 LovableMindless-VM systemd[1]: Failed to start Docker Application Container Engine.
dpkg: error processing package docker-ce (--configure):
installed docker-ce package post-installation script subprocess returned error exit status 1
Setting up git (1:2.30.2-1) ...
Setting up docker-ce-rootless-extras (5:20.10.21~3-0~debian-bullseye) ...
Processing triggers for man-db (2.9.4-2) ...
Processing triggers for libc-bin (2.31-13) ...
Errors were encountered while processing:
docker-ce
E: Sub-process /usr/bin/dpkg returned an error code (1)
尝试运行dockerd查看原因：


可以看到是在使用iptables创建NAT链时出错，遂谷歌查找原因，在docker论坛找到一个回答


原因是debian11使用nftables代替了iptables，执行iptables等同于nftables
根据回答运行以下命令：
sudo update-alternatives --set iptables /usr/sbin/iptables-legacy
sudo update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy上面两行将iptables命令替换为原始版本的iptables
然后 apt install docker-ce 修复安装
启动服务 systemctl start docker.service
一切正常

<hr/>若执行以上操作后出现提示
WARN[2022-11-26T11:14:24.572196594-05:00] Running modprobe bridge br_netfilter failed with message: modprobe: ERROR: could not insert 'bridge': Key was rejected by service
modprobe: ERROR: could not insert 'br_netfilter': Key was rejected by service
insmod /lib/modules/5.10.0-8-amd64/kernel/net/bridge/bridge.ko
insmod /lib/modules/5.10.0-8-amd64/kernel/net/bridge/bridge.ko
, error: exit status 1 可能由于系统处于KVM等虚拟化系统之下所致，由于需要和宿主机通讯，某些系统或云服务商会修改iptables规则，导致和docker冲突。（主要是libvert的原因）
最优方法是手动配置iptables，若无安全性等需求也可以禁止docker自动修改iptables
创建 /etc/docker/daemon.json ，写入以下内容
{
        "iptables": false
}保存重启服务即可

小张说物理

撸过