28

The problem, actually a feature: br_netfilter
The explanation is that the bridge netfilter code is enabled by Docker for internal container isolation: intended among other usages for stateful bridge firewalling or for leveraging iptables' matches and targets from bridge path without having to (or...