This article highlights issues that arise when deploying network address translation middle-boxes through containers. We focus on Docker as the container technology of choice and present a thorough analysis of its networking model, with special attention to the default bridge network driver that is used to implement network address translation functionality. We discuss some unexpected shortcomings we identified and elaborate on the suitability of containers for deploying services based on the Interactive Connectivity Establishment standard protocol. To support our findings, we present experiments we conducted in a real-world operational environment, namely a WebRTC service based on the Janus media server.

中文翻译：

---

容器 NAT 和面向会话的标准：朋友还是敌人？

本文重点介绍了通过容器部署网络地址转换中间盒时出现的问题。我们专注于 Docker 作为首选容器技术，并对其网络模型进行了全面分析，特别关注用于实现网络地址转换功能的默认网桥网络驱动程序。我们讨论了我们发现的一些意想不到的缺点，并详细阐述了基于交互式连接建立标准协议的容器部署服务的适用性。为了支持我们的发现，我们展示了我们在真实操作环境中进行的实验，即基于 Janus 媒体服务器的 WebRTC 服务。