libvirt: enable nftables by default

The iptables kernel modules (MASQUERADE, etc.) are increasingly
unavailable — the broader container ecosystem has moved to nftables
(netavark dropped iptables entirely, incus prefers nft). Without
nftables enabled, libvirtd's default network fails to start with
"Extension MASQUERADE revision 0 not supported, missing kernel module".

Add nftables to the default PACKAGECONFIG. This switches the firewall
backend priority to nftables,iptables (prefer nft, fall back to
iptables) and changes RDEPENDS from iptables to nftables + iproute2-tc.

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/recipes-extended/libvirt/libvirt_git.bb b/recipes-extended/libvirt/libvirt_git.bb
index 40b3f31a..ad58260f 100644
--- a/recipes-extended/libvirt/libvirt_git.bb
+++ b/recipes-extended/libvirt/libvirt_git.bb
@@ -129,7 +129,7 @@ SYSTEMD_SERVICE:${PN}-libvirtd = " \
 
 # full config
 PACKAGECONFIG ??= "gnutls qemu openvz vmware vbox esx lxc test remote \
-                   libvirtd udev python fuse firewalld libpcap \
+                   libvirtd udev python fuse firewalld libpcap nftables \
                    ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'selinux audit libcap-ng', '', d)} \
                    ${@bb.utils.contains('DISTRO_FEATURES', 'xen', 'libxl', '', d)} \
                    ${@bb.utils.contains('DISTRO_FEATURES', 'polkit', 'polkit', '', d)} \