docker-ce fails to start on AlmaLinux/RHEL 10 due to missing xt_addrtype module now that iptables no longer pulls in kernel-modules-extra unconditionally

Environment:

• OS: AlmaLinux 10.2
• Docker version: Docker version 29.6.2, build dfc4efb
• iptables: iptables-nft-1.8.11-15.el10_2.x86_64

Description:

dockerd fails to start with:

failed to start daemon: Error initializing network controller: error obtaining controller instance: failed to register "bridge" driver: failed to add jump rules to ipv4 NAT table: failed to append jump rules to nat-PREROUTING: (COMMAND_FAILED: '/usr/sbin/iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER' failed: Warning:
Extension addrtype revision 0 not supported, missing kernel module?

Root cause:

The addrtype match requires the xt_addrtype kernel module, provided by the kernel-modules-extra package on RHEL-family distros. Until recently, kernel-modules-extra was pulled in automatically as an unconditional Recommends of iptables-nft, so it was present on any system with Docker installed, even though docker-ce itself never declared it as a dependency.

That changed upstream in iptables 1.8.11-15.el10:

• Thu Jun 18 2026 Phil Sutter psutter@redhat.com [1.8.11-15.el10]

• spec: Recommend kernel-modules-extra only if no other
  recommendation applies (Phil Sutter) [RHEL-186232]
  Resolves: RHEL-186232

Source: https://git.almalinux.org/rpms/iptables/commit/bdfc71a038368010b31ac9ceb282ba4b23323455

With this change, kernel-modules-extra is no longer reliably installed as a side effect of installing iptables-nft. Since docker-ce.spec does not list kernel-modules-extra as a Requires or Recommends itself, fresh installs of Docker on updated RHEL 10 / AlmaLinux 10 / Rocky 10 systems can now fail to start with the error above, depending on the exact iptables package version and what else is installed on the host.

Requested fix:

Add an explicit Requires (or at minimum Recommends) on kernel-modules-extra in rpm/SPECS/docker-ce.spec for RHEL-family targets (rhel-9, rhel-10, centos-9, centos-10), since dockerd's default bridge network setup depends on the addrtype match and can no longer assume it will be pulled in transitively via iptables.

Workaround in the meantime:

dnf install kernel-modules-extra
systemctl restart docker.service

Start with rpm/SPECS/docker-ce.spec and inspect the dependency conditionals for rhel-9, rhel-10, centos-9, and centos-10. Confirm that installations on those targets receive kernel-modules-extra, then verify the generated package metadata or installation behavior and that dockerd can start with the addrtype module available.