It is possible and preferable to perform IP forwarding detection at the interface level by manipulating sysctls such as net.ipv4.conf.eth0.forwarding. Because some systems operators might prefer to granularly configure these forwarding tables without enabling it for all interfaces, docker should only check for forwarding on those interfaces it requires, rather than then 'default allow' sysctl of net.ipv4.ip_forward.

I have confirmed that containers may still reach out if I perform:

sysctl -w net.ipv4.ip_forward=0
sysctl -w net.ipv4.conf.eth0.forwarding=1