Ask HN: Containers and network access?

Tuning for any high load, the first thing you need to do is turn off conntrack. But then you lose DNAT. Yet every container network guide depends on iptables and DNAT?!

What's the docker approved way to flatten the network and get routing directly to the container services? Or are people actually running with conntrack and DNAT in production? It seems like it can have a significant impact, which is why I'm seeking alternatives...

On another note... It seems like the ECMP fix is going to be coming to the kernel soon, there's a lot of hardware which will be ECMP capable, so that should hit the masses. I wish it were here sooner!