dockerd defaults to iptables while libvirtd prefers nftables.

The host system is configured to use nftables. The iptables interface is
replaced by iptables-nft.


- docker inserts its own rulesets via iptables-nft that drops NAT packages

  table ip nat { : somestuffs that jumps to DOCKER... }

  table ip filter { chain DOCKER {
      iifname != "docker0" oifname "docker0" counter packets 0 bytes 0 drop
   }}

- when libvirt network starts, it inserts the nftables rules (for e.g. virbr0)
  to the _bottom_... which is overruled by the docker filters


Trivial fix is to allow virbr0 in DOCKER filters.

  sudo iptables -I DOCKER-USER -i virbr0 -j ACCEPT
  sudo iptables -I DOCKER-USER -o virbr0 -j ACCEPT