fix(config): trim container kernel config to what dockerd actually uses

Drop the duplicate CONFIG_NETFILTER_XT_MATCH_IPVS line, the legacy
IP_NF_*/IP6_NF_TARGET_MASQUERADE/MANGLE netfilter backend, IP_VS,
NF_CONNTRACK_PROCFS, NF_LOG_SYSLOG, and the unused XT_MATCH_MULTIPORT/
PHYSDEV/STATE matches. Verified against a running dockerd + docker
compose (bridge network, published port, embedded DNS): every rule
dockerd installs lands in the nftables backend via NFT_COMPAT, the raw
table stays empty, and none of the removed matches/legacy tables ever
register. IP6_NF_IPTABLES/FILTER/NAT stay, since dockerd's default
ip6tables scaffolding does write real rules there.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: G4614

config-patches/0001-container-kernel-config.patch

@@ -1,20 +1,34 @@
 diff --git a/config-libkrunfw-container_x86_64 b/config-libkrunfw-container_x86_64
 --- a/config-libkrunfw-container_x86_64
 +++ b/config-libkrunfw-container_x86_64
-@@ -2409,1 +2409,56 @@
+@@ -2409,1 +2409,55 @@
  # end of Kernel hacking
 +
 +# Container runtime support on top of the lean profile. Everything is built in
 +# (=y) because the guest has no /lib/modules and cannot load modules at runtime.
++#
++# Only the nftables backend is enabled. Docker/Podman on Alpine and Debian both
++# default to iptables-nft (xtables-nft-multi), and dockerd's own entrypoint
++# probe only falls back to the legacy ip_tables/ip6_tables backend when it
++# finds pre-existing legacy rules or nft fails outright. Verified empirically
++# against a running dockerd + docker compose (bridge network, published port,
++# embedded DNS): every rule dockerd installs lands in the nftables ip/ip6
++# tables via CONFIG_NFT_COMPAT (visible as "xt match"/"xt target" in `nft -a
++# list ruleset`), and the legacy CONFIG_IP_NF_*/CONFIG_IP6_NF_* backend never
++# registers a single table (/proc/net/ip_tables_names stays empty). Keeping
++# both backends compiled in is dead weight at best; at worst it makes the
++# backend dockerd picks depend on incidental kernel config (any legacy table
++# ever registering flips dockerd to legacy, silently disabling everything
++# below), and nf_tables is one of the most-exploited local-privesc surfaces in
++# recent kernels. Everything below was cross-checked against the same running
++# setup for actual use.
 +CONFIG_BRIDGE=y
 +CONFIG_BRIDGE_NETFILTER=y
 +CONFIG_LLC=y
 +CONFIG_STP=y
 +CONFIG_NETFILTER=y
 +CONFIG_NETFILTER_ADVANCED=y
 +CONFIG_NF_CONNTRACK=y
-+CONFIG_NF_CONNTRACK_PROCFS=y
-+CONFIG_NF_LOG_SYSLOG=y
 +CONFIG_NETFILTER_XTABLES=y
 +CONFIG_NETFILTER_XT_MARK=y
 +CONFIG_NETFILTER_XT_CONNMARK=y
@@ -23,22 +37,12 @@ diff --git a/config-libkrunfw-container_x86_64 b/config-libkrunfw-container_x86_
 +CONFIG_NETFILTER_XT_NAT=y
 +CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
 +CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
-+CONFIG_NETFILTER_XT_MATCH_IPVS=y
-+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
-+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=y
 +CONFIG_NF_NAT=y
 +CONFIG_NF_NAT_REDIRECT=y
 +CONFIG_NF_NAT_MASQUERADE=y
-+CONFIG_IP_NF_IPTABLES=y
-+CONFIG_IP_NF_FILTER=y
-+CONFIG_IP_NF_NAT=y
-+CONFIG_IP_NF_TARGET_MASQUERADE=y
-+CONFIG_IP_NF_MANGLE=y
 +CONFIG_IP6_NF_IPTABLES=y
 +CONFIG_IP6_NF_FILTER=y
 +CONFIG_IP6_NF_NAT=y
-+CONFIG_IP6_NF_TARGET_MASQUERADE=y
-+CONFIG_IP6_NF_MANGLE=y
 +CONFIG_NF_TABLES=y
 +CONFIG_NF_TABLES_INET=y
 +CONFIG_NF_TABLES_IPV4=y
@@ -50,14 +54,6 @@ diff --git a/config-libkrunfw-container_x86_64 b/config-libkrunfw-container_x86_
 +CONFIG_NFT_REJECT=y
 +CONFIG_NFT_CHAIN_NAT=y
 +CONFIG_NFT_COMPAT=y
-+CONFIG_IP_NF_TARGET_REJECT=y
-+CONFIG_IP6_NF_TARGET_REJECT=y
-+CONFIG_NETFILTER_XT_MATCH_STATE=y
 +CONFIG_NET_NS=y
 +CONFIG_POSIX_MQUEUE=y
-+# Docker's contrib/check-config.sh also lists these as necessary.
-+CONFIG_IP_NF_RAW=y
-+CONFIG_IP6_NF_RAW=y
-+CONFIG_IP_VS=y
-+CONFIG_NETFILTER_XT_MATCH_IPVS=y
 +CONFIG_EXT4_FS_POSIX_ACL=y