<p>According to the <a href="https://docs.docker.com/network/iptables/" rel="nofollow noreferrer">docker docs</a> (emphasis mine):</p>
<blockquote>
<p>On Linux, Docker manipulates iptables rules to provide network isolation. While this is an implementation detail (...) <em>you should not modify</em> the rules Docker inserts into your iptables policies ...</p>
</blockquote>
<p>and</p>
<blockquote>
<p>It is possible to set the iptables key to false in the Docker engine’s configuration file at /etc/docker/daemon.json, but <em>this option is not appropriate for most users</em>. It is not possible to completely prevent Docker from creating iptables rules, and creating them after-the-fact is <em>extremely involved</em> and beyond the scope of these instructions. Setting iptables to false will more than likely <em>break container networking</em> for the Docker engine.</p>
</blockquote>
<p>The docs do make it rather clear that you shouldn't mess up with these options but they don't give any further information. So, the question is what exactly are the problems of disabling the iptables manipulation by docker?
How will that affect running:</p>
<ul>
<li>standalone containers?</li>
<li>docker-compose?</li>
<li><a href="https://docs.docker.com/engine/swarm/" rel="nofollow noreferrer">docker-swarm mode</a>?</li>
<li>kubernetes?</li>
</ul>
<p>I am assumming that container internet connectivity will be handled by setting up NAT rules for <code>docker0</code> manually, as described e.g. <a href="https://blog.daknob.net/debian-firewall-docker/" rel="nofollow noreferrer">here</a>.</p>

<p>I decided to answer part of the question related to Kubernetes.<br />
Typical Kubernetes network setup relies on third-party tools (<a href="https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/" rel="nofollow noreferrer">CNI plugins</a>) that comply with the <a href="https://github.com/containernetworking/cni/blob/master/SPEC.md#container-network-interface-specification" rel="nofollow noreferrer">Container Network Interface Specification</a>. You can find different Kubernetes networking options
in the <a href="https://kubernetes.io/docs/concepts/cluster-administration/networking/#how-to-implement-the-kubernetes-networking-model" rel="nofollow noreferrer">Kubernetes networking model</a> documentation.</p>
<p>Kubernetes has its own set of <code>iptables</code> rules managed by <code>kube-proxy</code> to do all kinds of filtering and NAT between pods and services. The most important chains are <code>KUBE-SERVICES</code>, <code>KUBE-SVC-*</code> and <code>KUBE-SEP-*</code> (see: <a href="https://kubernetes.io/blog/2019/03/29/kube-proxy-subtleties-debugging-an-intermittent-connection-reset/#kubernetes-networking-basics" rel="nofollow noreferrer">Kubernetes networking basics</a> ).</p>
<p>It’s also important to know that Kubernetes doesn't need to use docker default bridge ( <code>docker0</code>), as it uses CNI for network setup. Each Kubernetes CNI plugin works in a bit different way, so it's better to check the detailed concepts in their official documentation.</p>
