Running this on a different terminal while the script in description was running made it even worse.

In this case "nft list ruleset" was hung for 110 minutes until <Ctrl-C> and the script adding chains was taking 4-5 seconds per chain.

# time nft list ruleset|wc -l

^C

real	110m21.597s
user	19m42.535s
sys	68m53.753s

Also when I ran:

for a in {1..35000}
do
	echo table: $a
	nft add table inet t$a 
 }
done

after that completed nft crashes with an OOM:

# nft list ruleset|wc -l
Connection to kvm-xxx closed by remote host.
Connection to kvm-xxx closed.

[70996.476272] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/user.slice/user-0.slice/session-5.scope,task=nft,pid=105241,uid=0
[70996.478180] Out of memory: Killed process 105241 (nft) total-vm:7548104kB, anon-rss:3460780kB, file-rss:0kB, shmem-rss:0kB, UID:0 pgtables:14808kB oom_score_adj:0

I'll add a new bugzilla for the OOM.

Testing on RHEL-9.2.0-20230305.14 on a beaker machine with 24 physical cores on
two CPUs and 251GB RAM:

Kernel supports at most 1023 base chains, so limited testing here:

| # nft add table t
| # time for ((i=0;i<1023;i++)); do
| >   nft add chain t c$i '{ type filter hook forward priority filter; }'
| > done
| 
| real	0m2.474s
| user	0m1.195s
| sys	0m1.328s

Non-base chains are unlimited. Picking up the 35k benchmark from earlier tests:

| # time for ((i=0;i<35000;i++)); do nft add chain t c$i; done
| 
| real	1m32.245s
| user	0m40.885s
| sys	0m52.719s

This is mostly 'nft' call overhead:

# time (for ((i=0;i<35000;i++)); do echo "add chain t c$i"; done | nft -f -)

real	0m0.334s
user	0m0.274s
sys	0m0.121s

So if one wants to create so many chains, nft is up for the task.

Adding tables is pretty slow and memory consuming. Their presence slows down
other tasks manipulating the ruleset because nft always fetches the full list
of tables if it needs a table cache. There is room for improvement, but unless
there's a good reason to use such many tables, investing time into improving
this is not feasible.

I'll hereby close this ticket. Please feel free to reopen in case you think
there's something to improve about performance of adding chains in RHEL9.