I still don't understand why $firewall isn't simply a psuedo fs like /proc and control is simply managing trees or chains using basic command line tools.
Well if you are hardcore you could probably hack some fuse abstraction that talks to netlink and does what you want. However it's probably not that straight forward to map nftables to directory/files.
