diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-firewall/nftables b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-firewall/nftables
new file mode 100644
index 0000000000..ce07686531
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-firewall/nftables
@@ -0,0 +1,5 @@
+nftables_install_mask=" /usr/libexec/nftables /var/lib/nftables /usr/lib/systemd/system/nftables-restore.service "
+
+INSTALL_MASK+=${nftables_install_mask}
+PKG_INSTALL_MASK+=${nftables_install_mask}
+unset nftables_install_mask