Merge pull request 'fix: update wg-easy to official ghcr image with iptables-nft' (#26) from fix/vpn-iptables-nft-upstream into master

Reviewed-on: #26

vpn/Dockerfile

@@ -3,7 +3,8 @@
 FROM ghcr.io/wg-easy/wg-easy:latest
 
 # The upstream image defaults to iptables-legacy via update-alternatives.
-# Switch iptables to the nftables backend (already provided by the 'iptables'
-# package on Alpine 3.18+). No apk add needed — iptables-nft is built-in.
-RUN update-alternatives --set iptables /usr/sbin/iptables-nft && \
+# Switch to iptables-nft so it works on kernels where only nftables
+# netfilter modules are available (iptable_nat module missing).
+RUN apk add --no-cache iptables-nft && \
+    update-alternatives --set iptables /usr/sbin/iptables-nft && \
     update-alternatives --set ip6tables /usr/sbin/ip6tables-nft