libnetwork

There is some real meat here, and things that should have been done long ago. A key thing is that the Docker network drivers (libnetwork) are becoming CNI compatable. This will vastly simplify one of the worst aspects of setting up Kubernetes, and ensure a consistent network space across containers, even if a given container is not in kube. That's nothing but awesome. https://github.com/docker/libnetwork/pull/1978/files

No, it doesn't. Go runtime can decide to spawn a new thread from the locked one. The new thread will inherit the characteristics (namespace, uid) of the old one. See https://github.com/docker/libnetwork/issues/1113 for more details.

Let me start off by saying yes it's awful that Docker is inserted at the top of the chain. This is a legacy that we'll have to work around to make work with existing rules. However, UFW is an awful iptables citizen as it assumes it is the sole owner of iptables. In general Docker does try to be a good iptables citizen and generally assume that it's not the only thing doing iptables work. The existing behavior where docker sits above everything else in iptables is unfortunate but has been around since forever and is not easy to change without breaking lots of existing installations. Please take a look at https://github.com/docker/libnetwork/pull/1675 as at least a partial solution to this.