Post #1234109
2026-03-16 09:34 UTC
@Larvitz I think your explanation of the docker behavior is incorrect. Port publishing using `-p` starts a docker-proxy userspace program on the host that listens on the specified port (effecting the input chain) and forwards the traffic to the container (using the output chain).
Using forwarding (with prerouting nat) instead could be faster.
The docker-proxy behavior enables port configurations like `127.0.0.1:80:8080`.
Replies (1)
-
@lbehm@chaos.social 2026-03-16 09:43
@Larvitz If you actually want to use docker, I highly recommend naming the container bridge interface. You can do that with the undocumented driver_opts setting: "com.docker.network.bridge.name" With that, you can filter in nftables using `iffname br-d-*`.