Since iptables only works for IPv4 packets (EthType 0x0800), it doesn't really seem unusual that you could still pass back and forth frames with different Ether

Since iptables only works for IPv4 packets (EthType 0x0800), it doesn't really seem unusual that you could still pass back and forth frames with different EtherTypes. There's a reason why filtering frames at layer 2 is a thing, but I suppose the average developer/Docker user wouldn't really be aware of it. I'm a senior network engineer at $work (ISP) and there are several locations in the network where I do this (the most common location is probably at IXP exchanges). Layer 2 security is something that most people overlook.