I really like the idea with network mode host. Because docker will not play with input iptables in a way that is confusing