I recently upgraded from Trixie to Forky, and libvirt and docker broke.

I've tracked the problem down to a bug (i think?) in the
linux-image-rt-amd64 kernel package that I use. In Trixie, the -rt
kernel includes ip_tables.ko, but in Forky it does not, and everything
that relies on iptables-legacy breaks. This includes docker and libvirt.

On Trixie:
    linux-image-6.12.74+deb13+1-rt-amd64

    root@5c1210865e65:/# find /lib/modules/6.12.74+deb13+1-rt-amd64/ -iname 'ip_tables*'
    /lib/modules/6.12.74+deb13+1-rt-amd64/kernel/net/ipv4/netfilter/ip_tables.ko.xz
    root@5c1210865e65:/#

On Forky:
    linux-modules-6.19.10+deb14-rt-amd64

    root@245245243fc6:/# find /lib/modules/6.19.10+deb14-rt-amd64/ -iname 'ip_tables*'
    root@245245243fc6:/#

On Forky i have to switch to the non-rt kernel, and docker and libvirt
start working again.

Control: tag -1 upstream wontfix
[...]

xtables (including iptables) did not work correctly on RT, so this
combination has been intentionally disabled upstream.  See
<https://git.kernel.org/linus/9fce66583f06c212e95e4b76dd61d8432ffa56b6>.

The xtables APIs are generally deprecated now, so docker and libvirt
should use nftables by default.  Bug #1130974 tracks this for libvirt.
For docker I think this was supposed to be addressed with bug #921600,
but there is still the related bug #903635 open.

Ben.