Bridge Netfilter

Questions
,
1

I want to run the sandbox runner on a Synology Diskstation via Docker compose

Describe the problem/error/question

The container does not start

Compose file:

============================================================

Sandbox Runner

Docker-in-Docker

============================================================

sandbox-runner-1:
image: Package n8n-sandbox-service-runner-dind · GitHub
container_name: n8n-sandbox-runner-1
privileged: true
depends_on:
sandbox-api:
condition: service_healthy
environment:
DOCKER_IGNORE_BR_NETFILTER_ERROR: “1”

--------------------------------------------------------

Connection Sandbox API

--------------------------------------------------------

SANDBOX_RUNNER_API_GRPC_ADDR: sandbox-api:9090
SANDBOX_RUNNER_HTTP_BASE_URL: https://sandbox-runner-1:8080

--------------------------------------------------------

Control gRPC

--------------------------------------------------------

SANDBOX_RUNNER_CONTROL_GRPC_LISTEN_ADDR: :9091
SANDBOX_RUNNER_CONTROL_GRPC_ADVERTISE_ADDR: sandbox-runner-1:9091

--------------------------------------------------------

Runner

--------------------------------------------------------

SANDBOX_RUNNER_ID: runner-1

--------------------------------------------------------

Sandbox Image

--------------------------------------------------------

SANDBOX_RUNNER_DOCKER_SANDBOX_IMAGE: Package n8n-sandbox-service-sandbox · GitHub

--------------------------------------------------------

Auth

--------------------------------------------------------

SANDBOX_RUNNER_REGISTRATION_TOKEN: ${SANDBOX_API_RUNNER_REGISTRATION_TOKEN}
SANDBOX_RUNNER_API_KEYS: ${SANDBOX_API_RUNNER_API_KEY}

--------------------------------------------------------

Registration gRPC TLS

--------------------------------------------------------

SANDBOX_RUNNER_REGISTRATION_GRPC_CA_FILE: /tls/runner/ca.crt
SANDBOX_RUNNER_REGISTRATION_GRPC_CERT_FILE: /tls/runner/grpc-client.crt
SANDBOX_RUNNER_REGISTRATION_GRPC_KEY_FILE: /tls/runner/grpc-client.key
SANDBOX_RUNNER_REGISTRATION_GRPC_SERVER_NAME: sandbox-api

--------------------------------------------------------

Control gRPC TLS

--------------------------------------------------------

SANDBOX_RUNNER_CONTROL_GRPC_TLS_CERT_FILE: /tls/runner/control-grpc-server.crt
SANDBOX_RUNNER_CONTROL_GRPC_TLS_KEY_FILE: /tls/runner/control-grpc-server.key
SANDBOX_RUNNER_CONTROL_GRPC_TLS_CLIENT_CA_FILE: /tls/runner/ca.crt
volumes:

  • sandbox-tls:/tls:ro
    restart: on-failure:5

What is the error message (if any)?

Container started
[start-runner] disk quota enforcement: not requested (SANDBOX_RUNNER_DEFAULT_DISK_QUOTA_MB unset or 0)
time=2026-10-28T19:31:31.068065879Z
level=ERROR
msg=create runtime
runtime=docker
error=bridge netfilter: /proc/sys/net/bridge/bridge-nf-call-iptables does not exist: load the br_netfilter kernel module on the host (kernels before 5.3 also lack it outside the host network namespace)

Please share your workflow

(Select the nodes on your canvas and use the keyboard shortcuts CMD+C/CTRL+C and CMD+V/CTRL+V to copy and paste the workflow.)

Share the output returned by the last node

Information on your n8n setup

  • n8n version:
  • Database (default: SQLite):
  • n8n EXECUTIONS_PROCESS setting (default: own, main):
  • Running n8n via (Docker, npm, n8n cloud, desktop app):
  • Operating system:
2

Hallo @Andreas90 welcome to the community
The DOCKER_IGNORE_BR_NETFILTER_ERROR doesn’t help here, because the error doesn’t come from the Docker daemon but from the sandbox runner’s own startup check. Before kernel 5.3, /proc/sys/net/bridge/bridge-nf-call-iptables only exists on the host, never inside a container, and a lot of DiskStations still run kernel 4.4 (check with uname -r over SSH). The image you had on 28.10 (v1.12.0) had no option for that yet. Since v1.13.0, which has been the stable image since 30.10, there is one.

Over SSH on the DiskStation, load the module with sudo modprobe br_netfilter and check that cat /proc/sys/net/bridge/bridge-nf-call-iptables prints 1 there. On kernel 5.3 or newer that’s already enough. On 4.4, run docker compose pull and replace DOCKER_IGNORE_BR_NETFILTER_ERROR on the runner with:

SANDBOX_RUNNER_DOCKER_ACK_BR_NETFILTER_IS_LOADED: "true"

That variable only skips the check. If the module isn’t actually loaded, the sandboxes can reach each other. It’s also gone after a reboot, so add the modprobe as a boot-up task in Task Scheduler.

3

A quick extra to the above comment: check first that br_netfilter even exists on your DSM (ls /lib/modules /usr/lib/modules 2>/dev/null | grep -i netfilter), since many kernel 4.4 Synologies don’t ship it. If it’s missing, the SANDBOX_RUNNER_DOCKER_ACK_... variable from above will be your only path. After that, docker logs n8n-sandbox-runner-1 will show what ends up failing next. With restart: on-failure:5 it quietly gives up after 5 tries. Also try running uname -m, because ARM DiskStations may not have a matching image build. What model and DSM version are you on?

4

That log is the runner refusing to start its Docker runtime because the host has no br_netfilter module, so the bridge iptables proc file never appears. The ignore variable does not create that file. On the NAS, over SSH, run modprobe br_netfilter and confirm the proc file exists before starting the stack again. If modprobe says the module is missing, Docker-in-Docker cannot build its bridge on that DSM kernel, and privileged mode will not get past this error. Also set the compose value to the plain digits 1, without curly quotes, and recreate the container so the variable is actually set.