fix: use ln -sf instead of update-alternatives --set

update-alternatives fails because iptables-nft isn't registered
as an alternative key (only iptables-legacy was registered by
the official Dockerfile). Direct symlink override works.

vpn/Dockerfile

@@ -2,9 +2,8 @@
 # Fixes crash-loop when host kernel lacks legacy iptable_nat module.
 FROM ghcr.io/wg-easy/wg-easy:latest
 
-# The upstream image defaults to iptables-legacy via update-alternatives.
-# Switch to iptables-nft so it works on kernels where only nftables
-# netfilter modules are available (iptable_nat module missing).
-RUN apk add --no-cache iptables-nft && \
-    update-alternatives --set iptables /usr/sbin/iptables-nft && \
-    update-alternatives --set ip6tables /usr/sbin/ip6tables-nft
+# The upstream image registers only iptables-legacy with update-alternatives.
+# iptables-nft binary exists but isn't registered as an alternative.
+# Override the alternatives-managed symlinks directly.
+RUN ln -sf /usr/sbin/iptables-nft /usr/sbin/iptables && \
+    ln -sf /usr/sbin/ip6tables-nft /usr/sbin/ip6tables