nftables with docker

docker-nftables.conf

# /etc/systemd/system/docker.service.d/docker-nftables.conf
# disable iptables in docker, allowing nftables to do work
[Service]
ExecStart=
ExecStart=/usr/bin/docker daemon -H fd:// --iptables=false

nftables.conf

#!/usr/bin/nft -f
# /etc/nftables.conf

table inet filter {
  chain input {
    type filter hook input priority 0;

    # allow established/related connections
    ct state {established, related} counter accept

    # early drop of invalid connections
    ct state invalid counter drop

    # allow from loopback
    iifname lo counter accept

    # allow icmp
    ip protocol icmp counter accept
    ip6 nexthdr icmpv6 counter accept

    # allow ssh
    # tcp dport ssh counter accept

    # everything else
    counter reject with icmp type port-unreachable
  }
  chain forward {
    type filter hook forward priority 0;
#    drop
  }
  chain output {
    type filter hook output priority 0;
  }

}

table ip nat {
  chain prerouting {
    type nat hook prerouting priority 0;
  }
  chain postrouting {
    type nat hook postrouting priority 0;
    oifname "eno1" counter masquerade
  }
}

prep_forwarding.sh

#!/bin/sh

cat > /etc/systemd/network/ipforward.network <<EOF
[Network]
IPForward=ipv4
EOF

cat > /etc/systemd/network/99-docker.conf <<EOF
net.ipv4.ip_forward = 1
EOF

sysctl -w net.ipv4.ip_forward=1

I'm not sure that you can. Docker still uses IPTables so there has be to a shim somewhere. I this gist is trying to do that but I was not able to get it to work. I did get docker-ce and iptables to work on RHEL 8:

https://gist.github.com/dmc5179/2f55cd54a6fdd103ab1873d52e3464a8

Change ExecStart= on the second line to ExecStart=/usr/bin/dockerd -H fd:// --iptables=false and it should work.

Also should use /etc/docker/daemon.json, settings {"iptables": false}, rather than using a custom systemd config file (or service).