A bridge netfilter sysctl is set correctly, but unloading and reloading the module resets the value and containers start bypassing the host policy

The host remains configured at rest, yet the live module state changed under the running workload.