From a64ee83ca3338284728aee385162bb114ba0d599 Mon Sep 17 00:00:00 2001 From: Dan Winship Date: Fri, 10 Jul 2026 15:17:09 -0400 Subject: [PATCH] Build nft with JSON (and xtables-compat) support We were installing the JSON build dep but not telling configure to use it. Also, in the interest of minimzing differences from upstream, add xtables support (which adds additional output when printing some `iptables-nft`-generated rules). --- dependencies.yaml | 4 ++-- images/build/distroless-iptables/Makefile | 2 +- .../distroless-iptables/distroless-bookworm/Dockerfile | 4 ++-- .../distroless-bookworm/patches/free-prototype.diff | 10 ---------- .../distroless-bookworm/patches/series | 2 +- .../distroless-iptables/distroless-trixie/Dockerfile | 4 ++-- .../distroless-trixie/patches/free-prototype.diff | 10 ---------- .../distroless-trixie/patches/series | 2 +- images/build/distroless-iptables/variants.yaml | 4 ++-- 9 files changed, 11 insertions(+), 31 deletions(-) delete mode 100644 images/build/distroless-iptables/distroless-bookworm/patches/free-prototype.diff delete mode 100644 images/build/distroless-iptables/distroless-trixie/patches/free-prototype.diff diff --git a/dependencies.yaml b/dependencies.yaml index 1bcc06f571b..4115e2ef921 100644 --- a/dependencies.yaml +++ b/dependencies.yaml @@ -422,7 +422,7 @@ dependencies: match: "DEBIAN_BASE_VERSION: 'bookworm-v((([0-9]+)\\.([0-9]+)\\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)'" - name: "registry.k8s.io/build-image/distroless-iptables (distroless-bookworm-go1.26)" - version: v0.9.5 + version: v0.9.6 refPaths: - path: images/build/distroless-iptables/Makefile match: IMAGE_VERSION\ \?=\ v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?) @@ -436,7 +436,7 @@ dependencies: match: GORUNNER_VERSION:\ \'v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)\' - name: "registry.k8s.io/build-image/distroless-iptables (distroless-bookworm-go1.25)" - version: v0.8.13 + version: v0.8.14 refPaths: - path: images/build/distroless-iptables/variants.yaml match: IMAGE_VERSION:\ \'v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)\' diff --git a/images/build/distroless-iptables/Makefile b/images/build/distroless-iptables/Makefile index 3ef6b6d88cb..0706c0a58b0 100644 --- a/images/build/distroless-iptables/Makefile +++ b/images/build/distroless-iptables/Makefile @@ -18,7 +18,7 @@ REGISTRY?="gcr.io/k8s-staging-build-image" IMAGE=$(REGISTRY)/distroless-iptables TAG ?= $(shell git describe --tags --always --dirty) -IMAGE_VERSION ?= v0.9.5 +IMAGE_VERSION ?= v0.9.6 CONFIG ?= distroless-bookworm BASEIMAGE ?= debian:bookworm-slim GORUNNER_VERSION ?= v2.4.0-go1.26.5-bookworm.0 diff --git a/images/build/distroless-iptables/distroless-bookworm/Dockerfile b/images/build/distroless-iptables/distroless-bookworm/Dockerfile index ecf910f494a..404b0114e34 100644 --- a/images/build/distroless-iptables/distroless-bookworm/Dockerfile +++ b/images/build/distroless-iptables/distroless-bookworm/Dockerfile @@ -24,7 +24,7 @@ RUN apt-get -y update && \ git ca-certificates build-essential autoconf automake libtool \ bison flex pkg-config libgmp-dev libreadline-dev \ libedit-dev libjansson-dev \ - libmnl-dev libnftnl-dev + libmnl-dev libnftnl-dev libxtables-dev # Build nftables ADD --checksum=sha256:bef0c9cfdca5f8b988957046c2cb33ef9869730593da0eacae4748201acf1116 https://netfilter.org/projects/nftables/files/nftables-1.0.6.1.tar.xz / @@ -32,7 +32,7 @@ COPY patches /patches COPY setup-metadata.sh /setup-metadata.sh RUN cd / && tar xf /nftables-1.0.6.1.tar.xz && cd nftables-1.0.6.1 && \ for p in $(cat /patches/series); do patch -p1 --forward < "/patches/$p" || exit 1; done && \ - ./configure --disable-man-doc --enable-static --disable-shared --sbindir=/usr/sbin && make && make install && \ + ./configure --with-json --with-xtables --disable-man-doc --enable-static --disable-shared --sbindir=/usr/sbin && make && make install && \ /setup-metadata.sh RUN ldconfig diff --git a/images/build/distroless-iptables/distroless-bookworm/patches/free-prototype.diff b/images/build/distroless-iptables/distroless-bookworm/patches/free-prototype.diff deleted file mode 100644 index 34840d671ab..00000000000 --- a/images/build/distroless-iptables/distroless-bookworm/patches/free-prototype.diff +++ /dev/null @@ -1,10 +0,0 @@ ---- nftables-1.0.6.1/src/parser_bison.y.orig 2026-06-21 10:14:26.854541200 -0400 -+++ nftables-1.0.6.1/src/parser_bison.y 2026-06-21 10:14:43.469373633 -0400 -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - #include - #include - #include diff --git a/images/build/distroless-iptables/distroless-bookworm/patches/series b/images/build/distroless-iptables/distroless-bookworm/patches/series index d59347567fa..8b137891791 100644 --- a/images/build/distroless-iptables/distroless-bookworm/patches/series +++ b/images/build/distroless-iptables/distroless-bookworm/patches/series @@ -1 +1 @@ -free-prototype.diff + diff --git a/images/build/distroless-iptables/distroless-trixie/Dockerfile b/images/build/distroless-iptables/distroless-trixie/Dockerfile index 970cfe9b392..563adcaa551 100644 --- a/images/build/distroless-iptables/distroless-trixie/Dockerfile +++ b/images/build/distroless-iptables/distroless-trixie/Dockerfile @@ -24,7 +24,7 @@ RUN apt-get -y update && \ git ca-certificates build-essential autoconf automake libtool \ bison flex pkg-config libgmp-dev libreadline-dev \ libedit-dev libjansson-dev \ - libmnl-dev libnftnl-dev + libmnl-dev libnftnl-dev libxtables-dev # Build nftables ADD --checksum=sha256:bef0c9cfdca5f8b988957046c2cb33ef9869730593da0eacae4748201acf1116 https://netfilter.org/projects/nftables/files/nftables-1.0.6.1.tar.xz / @@ -32,7 +32,7 @@ COPY patches /patches COPY setup-metadata.sh /setup-metadata.sh RUN cd / && tar xf /nftables-1.0.6.1.tar.xz && cd nftables-1.0.6.1 && \ for p in $(cat /patches/series); do patch -p1 --forward < "/patches/$p" || exit 1; done && \ - ./configure --disable-man-doc --enable-static --disable-shared --sbindir=/usr/sbin && make && make install && \ + ./configure --with-json --with-xtables --disable-man-doc --enable-static --disable-shared --sbindir=/usr/sbin && make && make install && \ /setup-metadata.sh RUN ldconfig diff --git a/images/build/distroless-iptables/distroless-trixie/patches/free-prototype.diff b/images/build/distroless-iptables/distroless-trixie/patches/free-prototype.diff deleted file mode 100644 index 34840d671ab..00000000000 --- a/images/build/distroless-iptables/distroless-trixie/patches/free-prototype.diff +++ /dev/null @@ -1,10 +0,0 @@ ---- nftables-1.0.6.1/src/parser_bison.y.orig 2026-06-21 10:14:26.854541200 -0400 -+++ nftables-1.0.6.1/src/parser_bison.y 2026-06-21 10:14:43.469373633 -0400 -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - #include - #include - #include diff --git a/images/build/distroless-iptables/distroless-trixie/patches/series b/images/build/distroless-iptables/distroless-trixie/patches/series index d59347567fa..8b137891791 100644 --- a/images/build/distroless-iptables/distroless-trixie/patches/series +++ b/images/build/distroless-iptables/distroless-trixie/patches/series @@ -1 +1 @@ -free-prototype.diff + diff --git a/images/build/distroless-iptables/variants.yaml b/images/build/distroless-iptables/variants.yaml index fcc59f5da06..6573b55c5f8 100644 --- a/images/build/distroless-iptables/variants.yaml +++ b/images/build/distroless-iptables/variants.yaml @@ -1,11 +1,11 @@ variants: distroless-bookworm-go1.26: CONFIG: 'distroless-bookworm' - IMAGE_VERSION: 'v0.9.5' + IMAGE_VERSION: 'v0.9.6' BASEIMAGE: 'debian:bookworm-slim' GORUNNER_VERSION: 'v2.4.0-go1.26.5-bookworm.0' distroless-bookworm-go1.25: CONFIG: 'distroless-bookworm' - IMAGE_VERSION: 'v0.8.13' + IMAGE_VERSION: 'v0.8.14' BASEIMAGE: 'debian:bookworm-slim' GORUNNER_VERSION: 'v2.4.0-go1.25.12-bookworm.0'