@koen@procolix.social FWIW in Docker there's an experimental nftables backend now: https://docs.docker.com/engine/network/firewall-nftables Give it a try!