I’ve been using docker since the early days. One of the early choices I made and stuck with is to never let Docker touch iptables.

I make a bridge for Docker to use and configure iptables rules myself via parallel config management.