When does Docker write to iptables?

Question

When the Docker daemon uses icc=true and iptables=true defaults, iptables are not written when linking --link containers. Only when I set icc=false iptables=true does iptables get written when linking containers with --link. Is this an error or am I missing something?

Answer 1

With --icc=true, containers have unrestricted network access to each other so no iptables rules are necessary to support --link. Only with --icc=false are there restrictions for which Docker needs to create exceptions.