A docker container can run in host networking mode. You could also disable the DNAT and route IPs to your containers. Docker uses network namespaces to create

A docker container can run in host networking mode. You could also disable the DNAT and route IPs to your containers. Docker uses network namespaces to create a bridge to the actual ethernet card - the DNAT part of things is only one possible configuration. IPv6 makes it easier to have routable addresses. The right choice is going to depend on the available infrastructure, performance requirements, workload profile, ... But really, in most environments, connection tracking simply isn't the bottleneck. Where it is, configure your systems not to use it.