instruction: Create a comprehensive Dockerfile for networking applications with best practices
output: ```dockerfile
  from each other.DOCKER-INGRESSRules related to Swarm networking.In the FORWARD chain, Docker adds rules that unconditionally jump to the
  DOCKER-USER, DOCKER-FORWARD and DOCKER-INGRESS chains.In the nat table, Docker creates chain DOCKER and adds rules to implement
  masquerading and port-mapping.Add iptables policies before Docker's rulesPackets that get accepted or rejected by rules in these custom chains will not
  be seen by user-defined rules appended to the FORWARD chain. So, to add
  additional rules to filter these packets, use the DOCKER-USER chain.Rules appended to the FORWARD chain will be processed after Docker's rules.Match the original IP and ports for requestsWhen packets arrive to the DOCKER-USER chain, they have already passed through
  a Destination Network Address Translation (DNAT) filter. That means that the
  iptables flags you use can only match internal IP addresses and ports of
  containers.If you want to match traffic based on the original IP and port in the network
  request, you must use the
  conntrack iptables extension.
  For example:
  
  $ sudo iptables -I DOCKER-USER -p tcp -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  $ sudo iptables -I DOCKER-USER -p tcp -m conntrack --ctorigdst 198.51.100.2 --ctorigdstport 80 -j ACCEPT
  
  ImportantUsing the conntrack extension may result in degraded performance.Port publishing and mappingBy default, for both IPv4 and IPv6, the daemon blocks access to ports that have not
  been published. Published container ports are mapped to host IP addresses.
  To do this, it uses iptables to perform Network Address Translation (NAT),
  Port Address Translation (PAT), and masquerading.For example, docker run -p 8080:80 [...] creates a mapping
  between port 8080 on any address on the Docker host, and the container's
  port 80. Outgoing connections
  ```