<p>I am reading the doc of <a href="https://istio.io/latest/blog/2019/data-plane-setup/" rel="nofollow noreferrer">istio</a>. It says:</p>
<blockquote>
<p>istio-init This init container is used to setup the iptables rules so that inbound/outbound traffic will go through the sidecar proxy.</p>
</blockquote>
<p>In my understanding, initContainer and application container are separated except that they share same network namespace. So why would iptables setup in initContainer still persist in application container?</p>

<p>As I mentioned in the comments, Iptables rules are briefly described <a href="https://github.com/istio/istio/wiki/Understanding-IPTables-snapshot" rel="nofollow noreferrer">here</a>.</p>
<p>There is also a Iptables Schematic:</p>
<p><a href="https://i.stack.imgur.com/bvnmk.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/bvnmk.png" alt="enter image description here" /></a></p>
