国内使用minikube start时，如果解决拉不到镜像的问题

Question

小白求问大佬们，如何解决卡在start时拉镜像的问题？
另外， 已经试过 minikube start --image-mirror-country='cn' 这样的方式，使用后报错。不太了解里面访问地址都是做什么用的？ 我本地的iptables没有做限制

$ minikube start --image-mirror-country='cn'
* minikube v1.25.1 on Centos 8.5.2111 (amd64)
* Automatically selected the docker driver
* Using image repository registry.cn-hangzhou.aliyuncs.com/google_containers
* Starting control plane node minikube in cluster minikube
* Pulling base image ...
* Creating docker container (CPUs=2, Memory=2200MB) .../ E0301 23:19:15.616741 1448075 network_create.go:95] error while trying to create docker network minikube 192.168.94.0/24: create docker network minikube 192.168.94.0/24 with gateway 192.168.94.1 and MTU of 1500: docker network create --driver=bridge --subnet=192.168.94.0/24 --gateway=192.168.94.1 -o --ip-masq -o --icc -o com.docker.network.driver.mtu=1500 --label=created_by.minikube.sigs.k8s.io=true minikube: exit status 1
stdout:

stderr:
Error response from daemon: Failed to Setup IP tables: Unable to enable SKIP DNAT rule:  (iptables failed: iptables --wait -t nat -I DOCKER -i br-ba27a2e7d102 -j RETURN: iptables: No chain/target/match by that name.
 (exit status 1))
! Unable to create dedicated network, this might result in cluster IP change after restart: un-retryable: create docker network minikube 192.168.94.0/24 with gateway 192.168.94.1 and MTU of 1500: docker network create --driver=bridge --subnet=192.168.94.0/24 --gateway=192.168.94.1 -o --ip-masq -o --icc -o com.docker.network.driver.mtu=1500 --label=created_by.minikube.sigs.k8s.io=true minikube: exit status 1
stdout:

stderr:
Error response from daemon: Failed to Setup IP tables: Unable to enable SKIP DNAT rule:  (iptables failed: iptables --wait -t nat -I DOCKER -i br-ba27a2e7d102 -j RETURN: iptables: No chain/target/match by that name.
 (exit status 1))

iptables规则

iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Answer 1

感觉重启一下本机的docker就能恢复

报错的意思是 iptables 的 nat 表下面没有 DOCKER 链。
正常情况下docker运行后，会在nat表下面和filter表下面创建几个DOCKER-XXX的链。

出现这个问题可能是在docker还在运行时执行了 iptables -F / iptables -X ，把docker创建的iptables规则给删掉了。