fix: use ln -sf instead of update-alternatives --set

update-alternatives fails because iptables-nft isn't registered
as an alternative key (only iptables-legacy was registered by
the official Dockerfile). Direct symlink override works.

vpn/Dockerfile

@@ -3,7 +3,7 @@
 FROM ghcr.io/wg-easy/wg-easy:latest
 
 # The upstream image registers only iptables-legacy with update-alternatives.
-# iptables-nft binary exists but isn't registered as an alternative key.
+# iptables-nft binary exists but isn't registered as an alternative.
 # Override the alternatives-managed symlinks directly.
 RUN ln -sf /usr/sbin/iptables-nft /usr/sbin/iptables && \
     ln -sf /usr/sbin/ip6tables-nft /usr/sbin/ip6tables