That privileged port thing is not true anymore for Docker created containers, since it lowers that limit and unprivileged containers can listen on any port.

That privileged port thing is not true anymore for Docker created containers, since it lowers that limit and unprivileged containers can listen on any port. docker run -ti --rm --user 1000:1000 --privileged=false alpine:latest ~ $ cat /proc/sys/net/ipv4/ip_unprivileged_port_start 0 ~ $ id uid=1000 gid=1000 groups=1000 ~ $ nc -lvp 80 listening on [::]:80 ... Also the iptable rules Docker creates is for routing traffic to container with destination NAT, to actually limit traffic you have to do it yourself by inserting rules in DOCKER_USER chain.