Using a Tailscale exit node on a Docker host

How to stop a Tailscale exit node from breaking Docker container networking, using Linux policy routing and a small systemd unit to make the fix permanent.