diff --git a/etc/runonce.d/97-iptables b/etc/runonce.d/97-iptables
new file mode 100755
index 0000000..3de3d04
--- /dev/null
+++ b/etc/runonce.d/97-iptables
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+# Docker doesn't play nicely with nftables. Use iptables-legacy instead.
+sudo update-alternatives --set iptables /usr/sbin/iptables-legacy
+sudo update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy