docker does funky stuff with iptables