I just wasted most of my evening debugging my server's nftables, which I was trying to set up to not ever send container traffic to my tailnet. Turns out I misread the required packet mark 0x80000 as 0x800000. I should really look into network namespaces, and just stuff Tailscale and the relevant services in one of those (is that how it works?)