just my two cents that netfilter (for which iptables is a frontend) is a kernel subsystem and therefore global to all containers on host.