"Imunify agent is not running" inside the container with nftables

Symptoms

• Imunify360's UI is unaccessible with the following error:

  Imunify agent is not running

• The steps described in the troubleshooting article do not help.

• Imunify360 is installed inside Virtuozzo container:

  # hostnamectl status | grep Virtualization
  Virtualization: openvz 
  
  # cat /proc/user_beancounters 
  Version: 2.5 
  ...

• iptables commands fail with the error:

  # iptables -A INPUT -s 8.8.8.8 -j ACCEPT
  iptables v1.8.4 (nf_tables): CHAIN_ADD failed (Device or resource busy): chain INPUT

• An older version of iptables is installed on the server node, e.g.:

  [root@servernode ~]# nft -v
  nftables v0.8 (Joe Btfsplk) 
  [root@servernode ~]# iptables -V 
  iptables v1.4.21 
  
  [root@container ~]# nft -v 
  nftables v0.9.3 (Topsy) 
  [root@container ~]# iptables --version 
  iptables v1.8.4 (nf_tables)

Cause

A mismatch of iptables version installed on the hardware node and inside the container. The server node uses legacy iptables, the guest uses nf_tables variant.

Resolution

• Disable nftables and enable iptables inside the container.

OR:

• Upgrade iptables on the server node.

For more details contact Virtuozzo support team.