title: Docker's NAT table output chain rule
body: <p>i am trying to understand one of the rules in the iptables:</p>
  
  <pre><code>$ sudo iptables -t nat  --list -v
  ...
  
  Chain OUTPUT (policy ACCEPT 618 packets, 31267 bytes)
   pkts bytes target     prot opt in     out     source               destination
      0     0 DOCKER     all  --  any    any     anywhere            !127.0.0.0/8          ADDRTYPE match dst-type LOCAL
  
  ...
  </code></pre>
  
  <p>so this rule is trying to match destination address type "LOCAL" and not in the range of 127.0.0.0/8?</p>
  
  <p>what address would it match then?
  what's the purpose of the this rule?</p>
  
  <p>thanks!</p>