Docker config for gitlab-runner on nftables

docker.nft

#!/usr/sbin/nft -f
# vim: ft=pf
# {{ interface }} would be `eth0` or `enp3s0` or similar
table inet filter {
  chain forward {
    iifname docker0 oifname {{ interface }} accept
    iifname {{ interface }} oifname docker0 ct state established accept
    iifname {{ interface }} oifname docker0 ct state related accept
  }
}


table ip nat {
  chain input {
    type nat hook input priority 0; policy accept;
  }
  chain output {
    type nat hook output priority 0; policy accept;
  }
  chain prerouting {
    type nat hook prerouting priority 0; policy accept;
  }
  chain postrouting {
    type nat hook postrouting priority 0; policy accept;
    ip saddr 172.17.0.0/16 counter masquerade
  }
}