I'm kind of looking forward to nftables, all the underlying technology driving it shows good learning from the weaknesses of iptables. Last time I looked, thou

I'm kind of looking forward to nftables, all the underlying technology driving it shows good learning from the weaknesses of iptables. Last time I looked, though, documentation was kind of nasty. Hopefully that's improved. One random thing I stumbled across with docker recently, is docker swarm requires a version of itpables that does locking (not entirely sure why, but it actually verifies that locking can happen, so presumably they got burned by it at some stage). The version of iptables stock from RHEL 6 (and thus CentOS 6) doesn't support it. So if you want to run docker swarm, RHEL6 and derivatives are a no go (other than Oracle Linux which seems to be determined to be as docker friendly as possible)