Comment by junon

This is right, I remember now - docker does mangle your iptables chains. I remember fighting with this a while back.

Terrible practice, in my opinion. Docker shouldn't be touching firewall stuff.