Fix Podman Error: netavark nftables 'nft did not return successfully' on Windows

You run podman compose up -d --build on Windows and get this:

Error response from daemon: netavark (exit code 1): nftables error: "nft" did not return successfully while applying ruleset
Error: executing docker-compose.exe -f docker-compose.yaml up -d --build: exit status 1

Your compose file is fine. This is a networking problem inside the Podman virtual machine. This article explains the cause and gives fixes, from the quickest to the most thorough.

Why this error happens

Podman is a Linux tool. On Windows it does not run containers natively. It starts a Linux virtual machine, called the Podman machine, on top of WSL2, and the containers run inside it.

Three components are involved:

• Netavark is Podman's network stack. It creates the networks and the port mappings (such as 5432:5432) for your containers.
• nftables is the Linux firewall framework. Netavark uses the nft command to apply firewall and NAT rules.
• WSL2 kernel is the kernel that the Podman machine uses. It must support the nftables modules.

The error means netavark called nft to apply a ruleset and nft failed. Common causes:

• Stale VM state. The VM was suspended, the PC went to sleep, or WSL was updated while the machine was running. The kernel modules and rule tables are then out of sync.
• Outdated WSL kernel. Older WSL2 kernels lack some nftables features that recent netavark versions need.
• Leftover networks or rules. A previous failed run left a network or firewall table that conflicts with the new one.
• Missing iptables/nftables userland in the VM image after an upgrade.

Because the failure happens while creating the network, it shows up for any service that publishes ports, even a simple Redis or PostgreSQL container.

Quick fix: restart WSL and the Podman machine

This fixes most cases. Run the commands in PowerShell:

podman machine stop
wsl --shutdown
wsl --update
podman machine start

Then retry:

podman compose -f docker-compose.yaml up -d --build

What each command does:

• podman machine stop Stops the Podman VM cleanly
• wsl --shutdown Stops every WSL2 VM, which clears the kernel and network state
• wsl --update Installs the latest WSL kernel with current nftables support
• podman machine start Boots a fresh VM with clean network rules

Alternative fixes

If the quick fix is not enough, try these in order.

1. Remove stale networks

podman compose -f docker-compose.yaml down
podman network prune -f
podman compose -f docker-compose.yaml up -d --build

2. Recreate the machine in rootful mode

Rootful mode often handles networking better on Windows. This deletes the machine's containers, images and volumes, so back up anything important first.

podman machine rm -f
podman machine init --rootful
podman machine start

3. Install iptables-nft in the VM

podman machine ssh "sudo rpm-ostree install iptables-nft"
podman machine stop
podman machine start

4. Check for interfering software

VPN clients and some firewalls modify WSL networking. Disable them temporarily to test.

5. Check port conflicts

If you see a different error afterward, a local PostgreSQL or Redis may already use ports 5432 or 6379:

netstat -ano | findstr ":5432 :6379"

How to prevent it

• Run wsl --update and update Podman Desktop or the Podman CLI regularly.
• Stop the machine with podman machine stop before shutting down or sleeping your PC.
• Run podman compose down when you finish a session.
• Prune unused networks now and then with podman network prune.

Conclusion

The "nft did not return successfully" error comes from stale or incompatible network state in the WSL2 VM that runs Podman, not from your project. Restarting WSL, updating it and restarting the Podman machine fixes it in most cases. Recreating the machine in rootful mode is the fallback.