Libvirt NAT and Docker

Writing this for myself because it has bitten me twice this year and I keep forgetting the solution.

On Fedora 44, installing Docker from the system repositories gives Docker v29 which still considers nftables support to be experimental so it uses iptables instead by default.

Installing libvirt and running a VM with the default NAT network results in the VM having no network connectivity, seemingly due to the iptables forward chain defaulting to a DROP/DENY policy.

This issue is documented in the Fedora Libvirt NFTables wiki but is not easily found until you've debugged why the VM networking isn't working.

A solution that has worked me, but is not suggested by the above wiki, is specifying {"firewall-backend": "nftables"} in the /etc/docker/daemon.json file and restarting the host machine. A Docker daemon restart alone isn't enough to clean up the existing iptables rules.

Hopefully this workaround will become redundant in the future by Docker switching to nftables by default.