- Docker no longer depends on the iptables filter-FORWARD chain's default policy being `DROP`
  in order to restrict access to unpublished container ports from remote hosts.
  - Direct routed access to container ports that are not exposed using `-p`/`--publish` is now blocked
     in the `DOCKER` chain.
  - If the default filter-FORWARD policy was previously left at `ACCEPT` on your host, and direct routed
    access to a container's unpublished ports from a remote host is still required, options are:
    - Publish the ports you need.
    - Re-create the network with `--gateway_mode_ipv4=routed` and/or `--gateway_mode_ipv6=routed`.
      - No NAT rules will be set up to map host addresses/ports to containers, but published ports will
        be accessible from remote hosts if routing has been set up in the network.
    - **FIXME** - mention `nat-unprotected`, to be implemented in an upcoming PR.
  - Container ports that are published to host addresses will continue to be accessible via those host
    addresses, using NAT or the userland proxy.
  - Unpublished container ports continue to be directly accessible from the docker host via the
    container's IP address.