fix: use ln -sf instead of update-alternatives --set

update-alternatives fails because iptables-nft isn't registered
as an alternative key (only iptables-legacy was registered by
the official Dockerfile). Direct symlink override works.

versioncontrol/compose.yml

@@ -8,10 +8,13 @@ services:
       - USER_GID=1000
       - GITEA__server__ROOT_URL=https://code.lazyworkhorse.net
       - GITEA__actions__ENABLED=true
+      - GITEA__actions__DEFAULT_ACTIONS_URL=off
       - SSH_PORT=2222
       - SSH_LISTEN_PORT=2222
       # Enable Gitea Actions (act_runner required on host)
       - GITEA__actions__ENABLED=true
+      # Don't fetch actions from GitHub (offline mode + local only)
+      - GITEA__actions__DEFAULT_ACTIONS_URL=off
     volumes:
       - /mnt/HoardingCow_docker_data/Gitea:/data
     networks:

vpn/Dockerfile

@@ -3,7 +3,7 @@
 FROM ghcr.io/wg-easy/wg-easy:latest
 
 # The upstream image registers only iptables-legacy with update-alternatives.
-# iptables-nft binary exists but isn't registered as an alternative key.
+# iptables-nft binary exists but isn't registered as an alternative.
 # Override the alternatives-managed symlinks directly.
 RUN ln -sf /usr/sbin/iptables-nft /usr/sbin/iptables && \
     ln -sf /usr/sbin/ip6tables-nft /usr/sbin/ip6tables