Takeaway: NAT around netnses is as about as bad a substitute for explicit filtering + proper bind discipline as it always was for local networks. So we should t

Takeaway: NAT around netnses is as about as bad a substitute for explicit filtering + proper bind discipline as it always was for local networks. So we should treat containers the same way we've long known to treat the hosts behind a NAT: sure, the NAT itself provides a little bit of defense in depth, but that's basically accidental and services should still be independently secured.