Keeping Docker containers off your LAN
Hardened Docker containers (no published ports, capabilities dropped) can still reach the whole LAN, because bridge NAT lets them connect anywhere the host can. The fix on OrbStack/macOS is a helper container that reapplies DOCKER-USER egress rules every 15s. The rules block private ranges, OrbStack's 0.250.250.0/24 host range and all non-bridge IPv6, allow DNS to OrbStack's resolver, and stay above the ACCEPT OrbStack inserts on restart. Lesson: test effect, not existence.
docker