https://elixir.bootlin.com/linux/latest/source/include/linux...

Also docker NAT will add significant latency if you don’t use host network mode.

When microseconds matter, everything matters. Any intermediate program would be suspect.

"Container" (namespace to be precise) is not really an intermediate program, it's a state associated with any Linux process.

A container is just namespaces and cgroups. You can still have your mellanox or solarflare zero-copy network stack for a containerised process.

That is, a containerised user space process can directly access the hardware, bypassing the kernel but isolated from other processes.

There are plenty of footguns for sure though but my experience working in HFT has been everyone is pretty elite skill-wise so sharp edges are not an issue in practice.