I've used a simple iptables approach to redirect traffic to new Docker container: iptables --wait --table nat --append PREROUTING --protocol tcp --dport 80 !

I've used a simple iptables approach to redirect traffic to new Docker container: iptables --wait --table nat --append PREROUTING --protocol tcp --dport 80 ! --in-interface docker0 --jump DNAT --to $new_target Then removing tables for old one: iptables --wait --table nat --delete PREROUTING --protocol tcp --dport 80 ! --in-interface docker0 --jump DNAT --to $old_target (repeat the same for ip6tables). The same had to be repeated on system start but otherwise it worked flawlessly and had zero-downtime.