bundles/docker-ce: sort nftables rules

bundles/docker-ce/metadata.py

@@ -12,14 +12,6 @@ defaults = {
             'docker-ce-cli': {},
         },
     },
-    'nftables': {
-        'rules': {
-            '00-docker-ce': {
-                'inet filter forward ct state { related, established } accept',
-                'inet filter forward iifname docker0 accept',
-            },
-        },
-    },
 }
 
 
@@ -27,7 +19,10 @@ defaults = {
     'nftables/rules/00-docker-ce',
 )
 def nftables_nat(metadata):
-    rules = set()
+    rules = {
+        'inet filter forward ct state { related, established } accept',
+        'inet filter forward iifname docker0 accept',
+    }
 
     for iface in metadata.get('interfaces'):
         rules.add(f'nat postrouting oifname {iface} masquerade')
@@ -35,7 +30,7 @@ def nftables_nat(metadata):
     return {
         'nftables': {
             'rules': {
-                '00-docker-ce': rules,
+                '00-docker-ce': sorted(rules),
             },
         },
     }