Docker even just messes with iptables in its default configuration/installation. It's always been a pain point especially if one wants to use the newer nftables.