dockerd crashes on Ubuntu 26.04 host

[benjamb]

Describe the bug

After upgrading our workers to Ubuntu 26.04, we started seeing the following errors from put steps:

time="2026-08-17T15:54:47.111921319Z" level=info msg="Deleting nftables IPv4 rules" error="exit status 1" output="Error: Could not process rule: No such file or directory\ndelete table ip docker-bridges"
time="2026-08-17T15:54:47.118765493Z" level=info msg="Deleting nftables IPv6 rules" error="exit status 1" output="Error: Could not process rule: No such file or directory\ndelete table ip6 docker-bridges"

...

time="2026-08-17T15:54:48.171794819Z" level=info msg="Daemon shutdown complete" error="failed to start daemon: Error initializing network controller: error obtaining controller instance: failed to register \"bridge\" driver: failed to create NAT chain DOCKER: iptables failed: iptables --wait -t nat -N DOCKER: iptables v1.8.13 (legacy): can't initialize iptables table `nat': Table does not exist (do you need to insmod?)\nPerhaps iptables or your kernel needs to be upgraded.\n (exit status 3)"
failed to start daemon: Error initializing network controller: error obtaining controller instance: failed to register "bridge" driver: failed to create NAT chain DOCKER: iptables failed: iptables --wait -t nat -N DOCKER: iptables v1.8.13 (legacy): can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
 (exit status 3)

Reproduction steps

1. Upgrade worker(s) to Ubuntu 26.04
2. Attempt a put step to this resource

Expected behavior

dockerd starts up and creates the necessary firewall rules using either nft or iptables-nft wrapper.

Additional context

The errors are no doubt linked to the fact that since version 6.17 of the linux kernel, CONFIG_NETFILTER_XTABLES_LEGACY defaults to disabled. Ubuntu 26.04 is using version 7.0.

The wolfi-base image still has the iptables command symlinked to /usr/bin/xtables-legacy-multi, rather than /usr/bin/xtables-nft-multi. Replacing that was enough to progress further when hijacked into the container. I'll follow up with an upstream issue for them to update the symlink.

I also progressed further with the --firewall-backend nftables argument to dockerd, perhaps a generic daemon_args parameter could be added to support this?