Allow configurable docker network (assists firewalling)

[dkopko]

This leaves the default of --network host but allows override. Being restricted to --network host makes certain firewall setups difficult/impossible, if one wanted to setup their host as DMZ accessible to the wider internet.

For example, allowing non-host networking and using a port serving argument like -p 127.0.0.1:7000:8000 along with the following /etc/nftables.conf firewall setup can allow setups where only SSH-forwarded ports are allowed to connect to the vLLM instance:

table inet docker_lockdown {
  chain preraw {
    #must run AFTER Docker DNAT (which is priority -100)
    type filter hook prerouting priority -50;

    # If traffic was DNATed (i.e. on a Docker-published port),
    # and destination is NOT loopback (i.e. it was pointed to us from outside), drop it
    ct status dnat ip daddr != 127.0.0.0/8 drop
    ct status dnat ip6 daddr != ::1 drop
  }
}