Docker Engine not starting on RHEL 10

[arunchincholi]

I am using RHEL 10.0 on AWS EC2.
As per the official Docker documentation, RHEL 10 is listed as supported.

However, after installing Docker CE and containerd from the official Docker repository, the installation succeeds but dockerd fails to start with exit-code errors.

The same steps work correctly on RHEL 9, Amazon Linux 2, and Amazon Linux 2023.

Could you please clarify:

Is Docker Engine / containerd fully supported on RHEL 10?

If not, when stable support is expected?

Any known issues or workarounds?

This will help us decide whether to continue with RHEL 10 or downgrade to RHEL 9.

[vvoland]

Could you please provide the error log you get from the engine?

I guess it's probably failing due to iptables failure?

RHEL 10 uses nftables by default and you need to install iptables-nft package if you want to use Docker iptables backend.

Docker has experimental nftables support you can try: https://docs.docker.com/engine/network/firewall-nftables

IIRC you RPM packages already should require either iptables-nft or iptables to be installed.. but maybe it's a bug?

[arunchincholi]

Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
[root@devopsmonitorproject apps]# docker images
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
[root@devopsmonitorproject apps]#

[root@devopsmonitorproject software]# sudo systemctl start docker
Job for docker.service failed because the control process exited with error code.
See "systemctl status docker.service" and "journalctl -xeu docker.service" for details.

-----------> Docker failed because containerd is missing or not running (Docker depends on it).

[vvoland]

Please show the output of journalctl -xeu docker.service

[arunchincholi]

I have terminated ec2 instance (RHEL 10) and did setup with amazon linux 2023, will share in the future. thanks...

…

On Thu, 15 Jan 2026 at 18:18, Paweł Gronowski ***@***.***> wrote: *vvoland* left a comment (docker/for-linux#1559) <#1559 (comment)> Please show the output of journalctl -xeu docker.service — Reply to this email directly, view it on GitHub <#1559 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BBE5ZHSZCDAM74K4Q22IYDD4G6EBXAVCNFSM6AAAAACRUHSDB6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTONJUGU4TSMJWGE> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[lethedata]

Ran into this issue on a fresh genericcloud AlmaLinux 10 (10.2-20260526.0) which is probably related to this.

As others have pointed out, setting the following fixes things. Both have to be set. dyrnq/install-docker#19 (comment) #1537 (comment)

/etc/docker/daemon.json - { "firewall-backend": "nftables" }
/etc/sysctl.d/99-docker.conf - net.ipv4.ip_forward=1

journal with docker debug (no change and just ip_forward)

time="2026-07-22T22:08:11.121738293Z" level=info msg="Starting up"
time="2026-07-22T22:08:11.122396118Z" level=debug msg="Listener created for HTTP on fd ()"
time="2026-07-22T22:08:11.122611830Z" level=info msg="OTEL tracing is not configured, using no-op tracer provider"
time="2026-07-22T22:08:11.122734621Z" level=info msg="CDI directory does not exist, skipping" dir=/etc/cdi
time="2026-07-22T22:08:11.122794734Z" level=info msg="CDI directory does not exist, skipping" dir=/var/run/cdi
time="2026-07-22T22:08:11.131931438Z" level=debug msg="Golang's threads limit set to 27270"
time="2026-07-22T22:08:11.132494238Z" level=info msg="Creating a containerd client" address=/run/containerd/containerd.sock timeout=1m0s
time="2026-07-22T22:08:11.132856029Z" level=debug msg="Using default logging driver json-file"
time="2026-07-22T22:08:11.133027467Z" level=debug msg="No quota support for local volumes in /var/lib/docker/volumes: Filesystem does not support, or has not enabled quotas"
time="2026-07-22T22:08:11.151004317Z" level=debug msg="metrics API listening on /var/run/docker/metrics.sock"
time="2026-07-22T22:08:11.152398043Z" level=debug msg="processing event stream" module=libcontainerd namespace=plugins.moby
time="2026-07-22T22:08:11.153313243Z" level=info msg="Loading containers: start."
time="2026-07-22T22:08:11.153349071Z" level=info msg="NRI is disabled"
time="2026-07-22T22:08:11.153489702Z" level=info msg="Starting daemon with containerd snapshotter integration enabled"
time="2026-07-22T22:08:11.153515966Z" level=debug msg="remote introspection plugin filters" filters="[type==\"io.containerd.snapshotter.v1\"]"
time="2026-07-22T22:08:11.163076903Z" level=info msg="Restoring containers: start."
time="2026-07-22T22:08:11.163125273Z" level=debug msg="Option DefaultDriver: bridge"
time="2026-07-22T22:08:11.163133809Z" level=debug msg="Option DefaultNetwork: bridge"
time="2026-07-22T22:08:11.163140747Z" level=debug msg="Network Control Plane MTU: 1500"
time="2026-07-22T22:08:11.164452351Z" level=debug msg="processing event stream" module=libcontainerd namespace=moby
time="2026-07-22T22:08:11.168845235Z" level=info msg="Deleting nftables IPv4 rules" error="running nft: /dev/stdin:1:17-30: Error: Could not process rule: No such file or directory\ndelete table ip docker-bridges\n                ^^^^^^^^^^^^^^\n exit status 1"
time="2026-07-22T22:08:11.173746365Z" level=info msg="Deleting nftables IPv6 rules" error="running nft: /dev/stdin:1:18-31: Error: Could not process rule: No such file or directory\ndelete table ip6 docker-bridges\n                 ^^^^^^^^^^^^^^\n exit status 1"
time="2026-07-22T22:08:11.175258540Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -C FORWARD -j DOCKER-ISOLATION]"
time="2026-07-22T22:08:11.176681865Z" level=debug msg="/usr/sbin/iptables, [--wait -t nat -D PREROUTING -m addrtype --dst-type LOCAL -j DOCKER]"
time="2026-07-22T22:08:11.181955004Z" level=debug msg="/usr/sbin/iptables, [--wait -t nat -D OUTPUT -m addrtype --dst-type LOCAL ! --dst 127.0.0.0/8 -j DOCKER]"
time="2026-07-22T22:08:11.186768447Z" level=debug msg="/usr/sbin/iptables, [--wait -t nat -D OUTPUT -m addrtype --dst-type LOCAL -j DOCKER]"
time="2026-07-22T22:08:11.191437778Z" level=debug msg="/usr/sbin/iptables, [--wait -t nat -D PREROUTING]"
time="2026-07-22T22:08:11.192759415Z" level=debug msg="/usr/sbin/iptables, [--wait -t nat -D OUTPUT]"
time="2026-07-22T22:08:11.194084603Z" level=debug msg="/usr/sbin/iptables, [--wait -t nat -F DOCKER]"
time="2026-07-22T22:08:11.195187512Z" level=debug msg="/usr/sbin/iptables, [--wait -t nat -X DOCKER]"
time="2026-07-22T22:08:11.196318091Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -F DOCKER-FORWARD]"
time="2026-07-22T22:08:11.197455600Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -X DOCKER-FORWARD]"
time="2026-07-22T22:08:11.198832463Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -F DOCKER-BRIDGE]"
time="2026-07-22T22:08:11.200242201Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -X DOCKER-BRIDGE]"
time="2026-07-22T22:08:11.201681844Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -F DOCKER]"
time="2026-07-22T22:08:11.203150256Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -X DOCKER]"
time="2026-07-22T22:08:11.204529186Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -F DOCKER-CT]"
time="2026-07-22T22:08:11.205939499Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -X DOCKER-CT]"
time="2026-07-22T22:08:11.207396326Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -F DOCKER-INTERNAL]"
time="2026-07-22T22:08:11.208774669Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -X DOCKER-INTERNAL]"
time="2026-07-22T22:08:11.210090502Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -F DOCKER-ISOLATION-STAGE-1]"
time="2026-07-22T22:08:11.211365706Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -X DOCKER-ISOLATION-STAGE-1]"
time="2026-07-22T22:08:11.212640497Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -F DOCKER-ISOLATION-STAGE-2]"
time="2026-07-22T22:08:11.213967566Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -X DOCKER-ISOLATION-STAGE-2]"
time="2026-07-22T22:08:11.215345936Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -F DOCKER-ISOLATION]"
time="2026-07-22T22:08:11.216758623Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -X DOCKER-ISOLATION]"
time="2026-07-22T22:08:11.218085726Z" level=debug msg="/usr/sbin/iptables, [--wait -t nat -n -L DOCKER]"
time="2026-07-22T22:08:11.219636893Z" level=debug msg="/usr/sbin/iptables, [--wait -t nat -N DOCKER]"
time="2026-07-22T22:08:11.221336351Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -n -L DOCKER]"
time="2026-07-22T22:08:11.223551590Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -N DOCKER]"
time="2026-07-22T22:08:11.225333844Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -n -L DOCKER-FORWARD]"
time="2026-07-22T22:08:11.227070967Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -N DOCKER-FORWARD]"
time="2026-07-22T22:08:11.228689591Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -n -L DOCKER-BRIDGE]"
time="2026-07-22T22:08:11.230229102Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -N DOCKER-BRIDGE]"
time="2026-07-22T22:08:11.231939206Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -n -L DOCKER-CT]"
time="2026-07-22T22:08:11.233627899Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -N DOCKER-CT]"
time="2026-07-22T22:08:11.235744565Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -n -L DOCKER-INTERNAL]"
time="2026-07-22T22:08:11.237382468Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -N DOCKER-INTERNAL]"
time="2026-07-22T22:08:11.239085263Z" level=debug msg="/usr/sbin/iptables, [--wait -t nat -C PREROUTING -m addrtype --dst-type LOCAL -j DOCKER]"
time="2026-07-22T22:08:11.244740436Z" level=debug msg="/usr/sbin/iptables, [--wait -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER]"
time="2026-07-22T22:08:11.259699548Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -F DOCKER-INTERNAL]"
time="2026-07-22T22:08:11.261206204Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -X DOCKER-INTERNAL]"
time="2026-07-22T22:08:11.264492581Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -F DOCKER-CT]"
time="2026-07-22T22:08:11.265825942Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -X DOCKER-CT]"
time="2026-07-22T22:08:11.268514064Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -F DOCKER-BRIDGE]"
time="2026-07-22T22:08:11.270065144Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -X DOCKER-BRIDGE]"
time="2026-07-22T22:08:11.273534528Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -F DOCKER-FORWARD]"
time="2026-07-22T22:08:11.275032300Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -X DOCKER-FORWARD]"
time="2026-07-22T22:08:11.277483843Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -F DOCKER]"
time="2026-07-22T22:08:11.278988210Z" level=debug msg="/usr/sbin/iptables, [--wait -t filter -X DOCKER]"
time="2026-07-22T22:08:11.282467887Z" level=debug msg="/usr/sbin/iptables, [--wait -t nat -D PREROUTING -m addrtype --dst-type LOCAL -j DOCKER]"
time="2026-07-22T22:08:11.288092385Z" level=debug msg="/usr/sbin/iptables, [--wait -t nat -D OUTPUT -m addrtype --dst-type LOCAL ! --dst 127.0.0.0/8 -j DOCKER]"
time="2026-07-22T22:08:11.292992628Z" level=debug msg="/usr/sbin/iptables, [--wait -t nat -D OUTPUT -m addrtype --dst-type LOCAL -j DOCKER]"
time="2026-07-22T22:08:11.298021595Z" level=debug msg="/usr/sbin/iptables, [--wait -t nat -D PREROUTING]"
time="2026-07-22T22:08:11.299506991Z" level=debug msg="/usr/sbin/iptables, [--wait -t nat -D OUTPUT]"
time="2026-07-22T22:08:11.300890066Z" level=debug msg="/usr/sbin/iptables, [--wait -t nat -F DOCKER]"
time="2026-07-22T22:08:11.302396822Z" level=debug msg="/usr/sbin/iptables, [--wait -t nat -X DOCKER]"
time="2026-07-22T22:08:11.304596175Z" level=debug msg="daemon configured with a 15 seconds minimum shutdown timeout"
time="2026-07-22T22:08:11.304732589Z" level=debug msg="start clean shutdown of all containers with a 15 seconds timeout..."
time="2026-07-22T22:08:11.305709105Z" level=debug msg="Cleaning up old mountid : start."
time="2026-07-22T22:08:11.306048788Z" level=debug msg="Cleaning up old mountid : done."
time="2026-07-22T22:08:11.306273917Z" level=info msg="Daemon shutdown complete" error="failed to start daemon: Error initializing network controller: error obtaining controller instance: failed to register \"bridge\" driver: failed to add jump rules to ipv4 NAT table: failed to append jump rules to nat-PREROUTING:  (iptables failed: iptables --wait -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER: Warning: Extension addrtype revision 0 not supported, missing kernel module?\niptables v1.8.11 (nf_tables):  RULE_APPEND failed (No such file or directory): rule in chain PREROUTING\n (exit status 4))"
failed to start daemon: Error initializing network controller: error obtaining controller instance: failed to register "bridge" driver: failed to add jump rules to ipv4 NAT table: failed to append jump rules to nat-PREROUTING:  (iptables failed: iptables --wait -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER: Warning: Extension addrtype revision 0 not supported, missing kernel module?
iptables v1.8.11 (nf_tables):  RULE_APPEND failed (No such file or directory): rule in chain PREROUTING
 (exit status 4))
Jul 22 22:08:11 docker-issue01 systemd[1]: docker.service: Main process exited, code=exited, status=1/FAILURE

daemon.json but no ip_forward

dockerd[26002]: time="2026-07-22T22:21:10.388667982Z" level=info msg="Starting up"
dockerd[26002]: time="2026-07-22T22:21:10.389850326Z" level=info msg="OTEL tracing is not configured, using no-op tracer provider"
dockerd[26002]: time="2026-07-22T22:21:10.390058353Z" level=info msg="CDI directory does not exist, skipping" dir=/var/run/cdi
dockerd[26002]: time="2026-07-22T22:21:10.390141001Z" level=info msg="CDI directory does not exist, skipping" dir=/etc/cdi
dockerd[26002]: time="2026-07-22T22:21:10.403098551Z" level=info msg="Creating a containerd client" address=/run/containerd/containerd.sock timeout=1m0s
dockerd[26002]: time="2026-07-22T22:21:10.424245423Z" level=info msg="Loading containers: start."
dockerd[26002]: time="2026-07-22T22:21:10.424395188Z" level=info msg="NRI is disabled"
dockerd[26002]: time="2026-07-22T22:21:10.424485575Z" level=info msg="Starting daemon with containerd snapshotter integration enabled"
dockerd[26002]: time="2026-07-22T22:21:10.437385763Z" level=info msg="Restoring containers: start."
dockerd[26002]: time="2026-07-22T22:21:10.469760575Z" level=info msg="stopping event stream following graceful shutdown" error="" module=libcontainerd namespace=moby
dockerd[26002]: time="2026-07-22T22:21:10.470207034Z" level=info msg="Daemon shutdown complete" error="failed to start daemon: Error initializing network controller: error creating default \"bridge\" network: IPv4 forwarding is disabled: check your host's firewalling and set sysctl net.ipv4.ip_forward=1, or disable this check using daemon option --ip-forward=false"
dockerd[26002]: failed to start daemon: Error initializing network controller: error creating default "bridge" network: IPv4 forwarding is disabled: check your host's firewalling and set sysctl net.ipv4.ip_forward=1, or disable this check using daemon option --ip-forward=false
systemd[1]: docker.service: Main process exited, code=exited, status=1/FAILURE

Package info

nftables v1.1.5 (Commodore Bullmoose #6)
iptables v1.8.11 (nf_tables)
Client: Docker Engine - Community

Version:    29.6.2

Context:    default

Debug Mode: false

Plugins:

buildx: Docker Buildx (Docker Inc.)

Version:  v0.35.0

Path:     /usr/libexec/docker/cli-plugins/docker-buildx

compose: Docker Compose (Docker Inc.)

Version:  v5.3.1

Path:     /usr/libexec/docker/cli-plugins/docker-compose
Server:

Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?