# Bridge Netfilter **URL:** \ **Category:** Questions\ **Tags:** docker, bug:unconfirmed\ **Created:** [November 2, 2026, 10:13am UTC](https://community.n8n.io/t/bridge-netfilter/326051 "2026-11-02T10:13:44Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Andreas90](https://dub1.discourse-cdn.com/n8n/user_avatar/community.n8n.io/andreas90/32/197430_2.png) [@Andreas90](https://community.n8n.io/u/Andreas90)\ **Post date:** [November 2, 2026, 10:13am UTC](https://community.n8n.io/t/bridge-netfilter/326051/1 "2026-11-02T10:13:44Z")
I want to run the sandbox runner on a Synology Diskstation via Docker compose ## Describe the problem/error/question The container does not start Compose file: > # ============================================================ > > # Sandbox Runner > > # > > # Docker-in-Docker > > # ============================================================ > > sandbox-runner-1: > image: [Package n8n-sandbox-service-runner-dind · GitHub](http://ghcr.io/n8n-io/n8n-sandbox-service-runner-dind:stable) > container\_name: n8n-sandbox-runner-1 > privileged: true > depends\_on: > sandbox-api: > condition: service\_healthy > environment: > DOCKER\_IGNORE\_BR\_NETFILTER\_ERROR: “1” > > # -------------------------------------------------------- > > # Connection Sandbox API > > # -------------------------------------------------------- > > SANDBOX\_RUNNER\_API\_GRPC\_ADDR: sandbox-api:9090 > SANDBOX\_RUNNER\_HTTP\_BASE\_URL: [https://sandbox-runner-1:8080](https://sandbox-runner-1:8080) > > # -------------------------------------------------------- > > # Control gRPC > > # -------------------------------------------------------- > > SANDBOX\_RUNNER\_CONTROL\_GRPC\_LISTEN\_ADDR: :9091 > SANDBOX\_RUNNER\_CONTROL\_GRPC\_ADVERTISE\_ADDR: sandbox-runner-1:9091 > > # -------------------------------------------------------- > > # Runner > > # -------------------------------------------------------- > > SANDBOX\_RUNNER\_ID: runner-1 > > # -------------------------------------------------------- > > # Sandbox Image > > # -------------------------------------------------------- > > SANDBOX\_RUNNER\_DOCKER\_SANDBOX\_IMAGE: [Package n8n-sandbox-service-sandbox · GitHub](http://ghcr.io/n8n-io/n8n-sandbox-service-sandbox:stable) > > # -------------------------------------------------------- > > # Auth > > # -------------------------------------------------------- > > SANDBOX\_RUNNER\_REGISTRATION\_TOKEN: ${SANDBOX\_API\_RUNNER\_REGISTRATION\_TOKEN} > SANDBOX\_RUNNER\_API\_KEYS: ${SANDBOX\_API\_RUNNER\_API\_KEY} > > # -------------------------------------------------------- > > # Registration gRPC TLS > > # -------------------------------------------------------- > > SANDBOX\_RUNNER\_REGISTRATION\_GRPC\_CA\_FILE: /tls/runner/ca.crt > SANDBOX\_RUNNER\_REGISTRATION\_GRPC\_CERT\_FILE: /tls/runner/grpc-client.crt > SANDBOX\_RUNNER\_REGISTRATION\_GRPC\_KEY\_FILE: /tls/runner/grpc-client.key > SANDBOX\_RUNNER\_REGISTRATION\_GRPC\_SERVER\_NAME: sandbox-api > > # -------------------------------------------------------- > > # Control gRPC TLS > > # -------------------------------------------------------- > > SANDBOX\_RUNNER\_CONTROL\_GRPC\_TLS\_CERT\_FILE: /tls/runner/control-grpc-server.crt > SANDBOX\_RUNNER\_CONTROL\_GRPC\_TLS\_KEY\_FILE: /tls/runner/control-grpc-server.key > SANDBOX\_RUNNER\_CONTROL\_GRPC\_TLS\_CLIENT\_CA\_FILE: /tls/runner/ca.crt > volumes: > > - sandbox-tls:/tls:ro > restart: on-failure:5 ## What is the error message (if any)? > Container started > [start-runner] disk quota enforcement: not requested (SANDBOX\_RUNNER\_DEFAULT\_DISK\_QUOTA\_MB unset or 0) > time=2026-10-28T19:31:31.068065879Z > level=ERROR > msg=create runtime > runtime=docker > error=bridge netfilter: /proc/sys/net/bridge/bridge-nf-call-iptables does not exist: load the br\_netfilter kernel module on the host (kernels before 5.3 also lack it outside the host network namespace) ## Please share your workflow ```auto (Select the nodes on your canvas and use the keyboard shortcuts CMD+C/CTRL+C and CMD+V/CTRL+V to copy and paste the workflow.) ``` ## Share the output returned by the last node ## Information on your n8n setup - **n8n version:** - **Database (default: SQLite):** - **n8n EXECUTIONS\_PROCESS setting (default: own, main):** - **Running n8n via (Docker, npm, n8n cloud, desktop app):** - **Operating system:** ---
**Author:** ![Deepankar](https://dub1.discourse-cdn.com/n8n/user_avatar/community.n8n.io/deepankar/32/197564_2.png) [@Deepankar](https://community.n8n.io/u/Deepankar)\ **Post date:** [November 2, 2026, 10:31am UTC](https://community.n8n.io/t/bridge-netfilter/326051/2 "2026-11-02T10:31:47Z")
Hallo @Andreas90 welcome to the community The DOCKER\_IGNORE\_BR\_NETFILTER\_ERROR doesn’t help here, because the error doesn’t come from the Docker daemon but from the sandbox runner’s own startup check. Before kernel 5.3, /proc/sys/net/bridge/bridge-nf-call-iptables only exists on the host, never inside a container, and a lot of DiskStations still run kernel 4.4 (check with `uname -r` over SSH). The image you had on 28.10 (v1.12.0) had no option for that yet. Since v1.13.0, which has been the `stable` image since 30.10, there is one. Over SSH on the DiskStation, load the module with `sudo modprobe br_netfilter` and check that `cat /proc/sys/net/bridge/bridge-nf-call-iptables` prints `1` there. On kernel 5.3 or newer that’s already enough. On 4.4, run `docker compose pull` and replace DOCKER\_IGNORE\_BR\_NETFILTER\_ERROR on the runner with: `SANDBOX_RUNNER_DOCKER_ACK_BR_NETFILTER_IS_LOADED: "true"` That variable only skips the check. If the module isn’t actually loaded, the sandboxes can reach each other. It’s also gone after a reboot, so add the modprobe as a boot-up task in Task Scheduler. ---
**Author:** ![AnthonyAtXRay](https://dub1.discourse-cdn.com/n8n/user_avatar/community.n8n.io/anthonyatxray/32/135767_2.png) [@AnthonyAtXRay](https://community.n8n.io/u/AnthonyAtXRay)\ **Post date:** [November 2, 2026, 4:21pm UTC](https://community.n8n.io/t/bridge-netfilter/326051/3 "2026-11-02T16:21:43Z")
A quick extra to the above comment: check first that `br_netfilter` even exists on your DSM (`ls /lib/modules /usr/lib/modules 2>/dev/null | grep -i netfilter`), since many kernel 4.4 Synologies don’t ship it. If it’s missing, the `SANDBOX_RUNNER_DOCKER_ACK_...` variable from above will be your only path. After that, `docker logs n8n-sandbox-runner-1` will show what ends up failing next. With `restart: on-failure:5` it quietly gives up after 5 tries. Also try running `uname -m`, because ARM DiskStations may not have a matching image build. What model and DSM version are you on? ---
**Author:** ![virse\_ai](https://avatars.discourse-cdn.com/v4/letter/v/85f322/32.png) [@virse\_ai](https://community.n8n.io/u/virse_ai)\ **Post date:** [November 2, 2026, 5:09pm UTC](https://community.n8n.io/t/bridge-netfilter/326051/4 "2026-11-02T17:09:47Z")
That log is the runner refusing to start its Docker runtime because the host has no br\_netfilter module, so the bridge iptables proc file never appears. The ignore variable does not create that file. On the NAS, over SSH, run modprobe br\_netfilter and confirm the proc file exists before starting the stack again. If modprobe says the module is missing, Docker-in-Docker cannot build its bridge on that DSM kernel, and privileged mode will not get past this error. Also set the compose value to the plain digits 1, without curly quotes, and recreate the container so the variable is actually set.