I had a problem today where Docker would not start up. Running dockerd directly in the console shows the problem:
$ sudo dockerd INFO[2026-08-23T20:54:33.973971366+02:00] Starting up INFO[2026-08-23T20:54:33.974243147+02:00] OTEL tracing is not configured, using no-op tracer provider INFO[2026-08-23T20:54:33.979653043+02:00] Creating a containerd client address=/run/containerd/containerd.sock timeout=1m0s INFO[2026-08-23T20:54:34.292977319+02:00] [graphdriver] using prior storage driver: overlay2 INFO[2026-08-23T20:54:34.295167083+02:00] Loading containers: start. INFO[2026-08-23T20:54:34.314354939+02:00] stopping event stream following graceful shutdown error="" module=libcontainerd namespace=moby failed to start daemon: Error initializing network controller: error obtaining controller instance: failed to register "bridge" driver: failed to create NAT chain DOCKER: iptables failed: iptables --wait -t nat -N DOCKER: iptables v1.8.13 (legacy): can't initialize iptables table `nat': Table does not exist (do you need to insmod?) Perhaps iptables or your kernel needs to be upgraded. (exit status 3)
In a previous iteration of debugging there was a message about missing kernel module ip_tables. I found the right options to enable it and updated and rebuilt my kernel, but this only made that message disappear, but didn't actually solve the problem. The problem was actually in userland. Notice that iptables is marked as "(legacy)" - that's a hint.
For a while, Linux had two kernel firewall systems — iptables and nftables. I've definitely used Docker before on this system, so apparently between then and now, iptables has finally been removed from the kernel. There is something called iptables-nft that simulates the iptables interface using nftables underneath.
I had some trouble finding out how to enable this on Gentoo. Installing the net-firewall/nftables package didn't work. There is no iptables-nft package. eselect iptables list only shows one option, which is the selected one, marked iptables-legacy-multi.
The solution is actually a use-flag in the net-firewall/iptables package. You must enable it in package.use by adding: net-firewall/iptables nftables. Then rebuild iptables with emerge net-firewall/iptables and there will now be two selections in eselect. I selected the new implementation with sudo eselect iptables xtables-nft-multi and then restarted Docker and it successfully started.
That's all today. Hopefully this shows up in some searches and helps someone else solve the same problem.