I don't think CoreOS does anything special in this regard. It should be possible via cloud-config to change the runtime config of the docker service[1], in whi

I don't think CoreOS does anything special in this regard. It should be possible via cloud-config to change the runtime config of the docker service[1], in which case one could set "--icc=false"[2] to enforce stricter rules about inter-container communication on a particular docker host (e.g. a coreos droplet). [1] https://coreos.com/docs/launching-containers/building/customizing-docker/ https://coreos.com/docs/launching-containers/building/custom... [2] https://docs.docker.com/articles/networking/#between-containers https://docs.docker.com/articles/networking/#between-contain... EDIT: Okay, I see you were asking about regulating network comm between containers on separate docker hosts, i.e. coreos instances. That's a good question! I still don't think CoreOS addresses that concern in any special way at the level of iptables and routing (but I could be wrong). What it does give you is the ability to control service affinity with respect to your fleet "units". That way, you can be certain that docker containers which need to be "linked" in order to communicate properly (e.g. you have set "--icc=false") will run on the same host.