daemon/libnetwork: make libnftables opt-in only

[corhere]

• Fixes dockerd crashes with SIGABRT due to libnftables select() / FD_SETSIZE overflow when fd >= 1024 #52873

Summary

As libnftables uses select(2) on the netlink socket the process is aborted if the socket's file descriptor is >= 1024. A dockerd process could easily exceed 1024 open file descriptors at a time under normal circumstances, so there is a risk of libnftables killing dockerd at a random time through no fault of dockerd. Default to programming nftables rulesets by exec'ing nft -f until libnftables is updated to be compatible with processes that open a large number of file descriptors by using poll(2) or epoll(2) instead of select(2).

Release notes (optional)

- Mitigate a crash in libnftables when using nftables as the firewall backend by changing the default build option to execute the `nft` command instead. Users building dockerd from source can opt into linking against libnftables by building with the `libnftables` build tag.

A picture of a cute animal (not mandatory but encouraged)

[thaJeztah]

LGTM

[thaJeztah]

Do we need a tracking-ticket to re-enable it once fixed upstream? Mostly considering that I think our intent was to do the exact reverse, and not depend on the binary.

[corhere]

Do we need a tracking-ticket to re-enable it once fixed upstream?

Yes, that's a good idea.