Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

docs: k8s CNI with Cilium example in docs/kubernetes.md

Open Beginner friendly
  • Is something wrong?
#2,332 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@zdk is already working on this.

Since Oct 2, 2026.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
76/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
helm, kubernetes, linux
Domain
documentation, networking

Research direction

Start with the Cilium example in docs/kubernetes.md and reproduce the commands using the recommended kernel. Review the Cilium agent error about the missing CONFIG_NETFILTER_XT_MATCH_SOCKET capability, then update the example or its surrounding guidance so the documented setup has an explicit, verifiable requirement for egress to work.

Written by the indexing model from the issue text.

Description

I have done the following
  • I have searched the existing issues
  • If possible, I've reproduced the issue using the 'main' branch of this project
Steps to reproduce

Use the recommended kernel (container system kernel set --recommended, 6.18.35),
then follow "Example: Cilium" in docs/kubernetes.md:

helm repo add cilium https://helm.cilium.io/
helm repo update
helm template cilium cilium/cilium --version 1.20.1 --namespace kube-system --set ipam.mode=kubernetes > cilium.yaml
container k8s create --name cilium-demo --cni ./cilium.yaml

Then test egress from a pod:

kubectl --context cilium-demo run t --image=busybox:1.37 --restart=Never --rm -i -- nslookup example.com
kubectl --context cilium-demo run t --image=busybox:1.37 --restart=Never --rm -i -- wget -qO- -T5 http://1.1.1.1
Problem description

The cluster looks healthy,

  • k8s create exits 0.
  • All pods are Running.
  • Cluster DNS works.

but pods cannot reach anything outside the cluster.

  • External DNS and internet by IP time out.
  • CoreDNS cannot reach its upstream:
    read udp 10.244.0.53:45400->192.168.64.1:53: i/o timeout

Cause: the kernel has no CONFIG_NETFILTER_XT_MATCH_SOCKET.

See in Cilium agent logs:

level=error msg="iptables rules full reconciliation failed, will retry another one later"
  error="failed to install rules: cannot install static proxy rules: unable to run
  'iptables -t mangle -A CILIUM_PRE_mangle -m socket --transparent ...'
  stderr=\"Warning: Extension socket revision 0 not supported, missing kernel module? ...\""

Expected: the documented example gives a working cluster, or the docs say what is missing.

Environment
- OS: macOS 27.0.1 (26A434)
- Xcode: 27.0 (27A266a)
- Container: container CLI version 1.5.0 (build: release, commit: d265d66)
- Kernel: 6.18.35 (vmlinux-6.18.35-197-debug, the recommended kernel for 1.5.0)
- Cilium: 1.20.1 (Helm chart, as in the docs).
Code of Conduct
  • I agree to follow this project's Code of Conduct
Dominant language
Swift
Stars
50.7k
Forks
1.8k
Avg merge
2d 17h
Merged PRs (30d)
31

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apple/container

All issues in apple/container

Similar issues

More Swift issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.