{
  "id": 325442,
  "title": "The Kernel Underneath Kubernetes: nftables, netfilter, and Why svclb-traefik Kept Crash-Looping",
  "url": "https://urgent.news/2026/08/08/the-kernel-underneath-kubernetes-nftables-netfilter-and-why-svclb",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-08T21:32:07.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/audu97/the-kernel-underneath-kubernetes-nftables-netfilter-and-why-svclb-traefik-kept-crash-looping-5cgi"
  },
  "original_language": "en",
  "account": "Netfilter, the foundation of the Linux networking stack, is a kernel subsystem that intercepts packets at various points in the network stack and makes decisions about them. Before nftables and iptables, there was netfilter, which provides a set of five hook points where kernel code can intercept packets and hand back a verdict.\n\nPacket classification is the process of determining which rules apply to a packet at each hook. There are two main ways to implement this: linear evaluation and indexed evaluation. Linear evaluation is a simple, sequential process that scans through a list of rules until a match is found, while indexed evaluation uses hash tables, sets, or interval trees to jump directly to the relevant rules, resulting in faster performance.\n\nIptables, ip6tables, arptables, and ebtables are four separate tools that were historically created to handle different protocol families (IPv4, IPv6, ARP, and Ethernet). Each tool has its own binary, kernel modules, match/target extensions, and no shared rule-set with the others. This fragmentation made it difficult to evaluate packets in complex environments like Kubernetes clusters with multiple network layers.\n\nnftables is an improvement over the previous tools, as it implements an indexed-evaluation engine as a small in-kernel virtual machine that interprets a compact bytecode program against structured data, such as sets, maps, and concatenated key lookups. This allows for faster performance and a more cohesive rule-set across different protocol families. By creating a single engine with multiple table families (ip, ip6, inet, arp, bridge, and netdev), nftables simplifies the packet classification process and improves overall system performance.",
  "summary": "A few weeks ago, I hit a bug that sent me further down the Linux networking stack than I'd gone in years: an NVIDIA Jetson device, running k3s at the edge, with svclb-traefik stuck in a CrashLoopBackOff that made no sense from the Kubernetes side. Pods scheduled fine. Images pulled fine. The manifests were correct. The problem was three layers below anything kubectl describe could tell me, in the…",
  "key_points": [
    "Netfilter is kernel subsystem intercepting packets at various points in network stack.",
    "nftables implements indexed-evaluation engine as small in-kernel virtual machine.",
    "nftables simplifies packet classification process and improves system performance."
  ],
  "editors_take": null,
  "illustration": "https://urgent.news/ill/325442.png",
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}