flowchart LR
  client["External client<br/>to host:8070"]
  hote["Host process<br/>to 127.0.0.1:8070"]
  pre["PREROUTING<br/>DNAT 8070 to 172.31.10.2:80"]:::accent
  proxy["docker-proxy<br/>host process, opens a connection to the container"]
  out["OUTPUT<br/>never reaches FORWARD"]
  subgraph fwd ["FORWARD hook: each base chain gives its own verdict"]
    subgraph filt ["FORWARD base chain<br/>ip filter table, priority filter"]
      user["DOCKER-USER<br/>administrator rules"]
      dfw["DOCKER-FORWARD<br/>Docker rules"]
    end
    autre["Host nftables table<br/>evaluated after, priority filter + 10, may have policy drop"]
  end
  pont["Network bridge<br/>172.31.10.0/24"]
  cont["Container c39-m-api<br/>172.31.10.2:80"]
  client ==> pre
  pre ==> user
  user ==> dfw
  dfw ==> autre
  autre ==> pont
  hote -.-> proxy
  proxy -.-> out
  out -.-> pont
  pont ==> cont