fix: docker-in-docker on Ubuntu 26.04 — verify iptables-legacy works before switching

[Copilot]

Docker daemon fails to start on Ubuntu 26.04 (resolute) because the kernel no longer supports legacy iptables NAT tables. The install script was unconditionally switching to iptables-legacy whenever the binary existed, regardless of kernel support.

Changes

• iptables fallback logic — Verify iptables-legacy actually works (-nL probe) before switching to it; fall back to iptables-nft if legacy fails:

  if type iptables-legacy > /dev/null 2>&1 && iptables-legacy -nL > /dev/null 2>&1; then
      update-alternatives --set iptables /usr/sbin/iptables-legacy
      update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
  elif type iptables-nft > /dev/null 2>&1 && iptables-nft -nL > /dev/null 2>&1; then
      update-alternatives --set iptables /usr/sbin/iptables-nft
      update-alternatives --set ip6tables /usr/sbin/ip6tables-nft
  fi

• Add resolute codename to DOCKER_MOBY_ARCHIVE_VERSION_CODENAMES and DOCKER_LICENSED_ARCHIVE_VERSION_CODENAMES
• Add test scenario docker_build_ubuntu_resolute targeting ubuntu:resolute with moby: false (moby is not yet supported on Ubuntu resolute)
• Minor version bump from 2.16.1 → 2.17.0 in devcontainer-feature.json

[Kaniska244]

@copilot Why assuming ubuntu-26.04 is plucky, shouldn't it be resolute?

[Copilot]

@copilot Why assuming ubuntu-26.04 is plucky, shouldn't it be resolute?

You're right — Ubuntu 26.04 LTS is "Resolute Raccoon", not "Plucky" (which is 25.04). Fixed in 77dbcc3: updated codenames and test scenario to use resolute.

[Kaniska244]

@copilot Do a minor version bump of the feature as well

[Copilot]

@copilot Do a minor version bump of the feature as well

Done — bumped from 2.16.1 → 2.17.0 in 6fc10b9.

[Kaniska244]

@copilot Set moby: false for resolute test. As of now, moby isn't supported by ubuntu resolute.

[Copilot]

@copilot Set moby: false for resolute test. As of now, moby isn't supported by ubuntu resolute.

Set moby: false for the resolute test scenario in ab61fec.

[Kaniska244]

@copilot Note down this exceptional behavior for ubuntu resolute in the feature documentation.

[Copilot]

@copilot Note down this exceptional behavior for ubuntu resolute in the feature documentation.

Added a note in src/docker-in-docker/NOTES.md documenting that Ubuntu 26.04 (Resolute) requires moby: false and automatically falls back to iptables-nft due to lack of legacy iptables kernel support. See 75d23c2.