dunno how I missed this: we are not going to automatically enable ip forwarding for anyone unless the docker team decides that docker itself is not useful without it (ie, their warning turns into a fatal error)