I'm not 100% sure this is the correct place. There are three places that we create mangle rules (and the last one in my list is the one you got bit by):

• SCTP packet egress:

  moby/libnetwork/iptables/iptables.go

  Lines 363 to 380 in b85185e

  	if proto == "sctp" {
  	// Linux kernel v4.9 and below enables NETIF_F_SCTP_CRC for veth by
  	// the following commit.
  	// This introduces a problem when conbined with a physical NIC without
  	// NETIF_F_SCTP_CRC. As for a workaround, here we add an iptables entry
  	// to fill the checksum.
  	//
  	// https://github.com/torvalds/linux/commit/c80fafbbb59ef9924962f83aac85531039395b18
  	args = []string{
  	"-p", proto,
  	"--sport", strconv.Itoa(destPort),
  	"-j", "CHECKSUM",
  	"--checksum-fill",
  	}
  	if err := iptable.ProgramRule(Mangle, "POSTROUTING", action, args); err != nil {
  	return err
  	}
  	}

• Encrypted overlay networks:

  moby/libnetwork/drivers/overlay/encryption.go

  Lines 228 to 250 in b85185e

  	func programMangle(vni uint32, add bool) error {
  	var (
  	m = strconv.FormatUint(mark, 10)
  	chain = "OUTPUT"
  	rule = append(matchVXLAN(overlayutils.VXLANUDPPort(), vni), "-j", "MARK", "--set-mark", m)
  	a = iptables.Append
  	action = "install"
  	)
  	// TODO IPv6 support
  	iptable := iptables.GetIptable(iptables.IPv4)
  	if !add {
  	a = iptables.Delete
  	action = "remove"
  	}
  	if err := iptable.ProgramRule(iptables.Mangle, chain, a, rule); err != nil {
  	return fmt.Errorf("could not %s mangle rule: %w", action, err)
  	}
  	return nil
  	}

• IPVS load-balancing:

  moby/libnetwork/service_linux.go

  Lines 547 to 554 in b85185e

  	for _, iPort := range ingressPorts {
  	var (
  	protocol = strings.ToLower(PortConfig_Protocol_name[int32(iPort.Protocol)])
  	publishedPort = strconv.FormatUint(uint64(iPort.PublishedPort), 10)
  	)
  	rule := []string{"-t", "mangle", addDelOpt, "PREROUTING", "-p", protocol, "--dport", publishedPort, "-j", "MARK", "--set-mark", fwMarkStr}
  	rules = append(rules, rule)
  	}

The latter two are only used with the overlay network driver, so I'm somewhat inclined to say that this should be scoped to the driver. On the other hand, we do rely on this for SCTP in certain situations, and other netfilter/xtables features are listed here.

I'll defer to @akerouanton and @corhere on whether this should be moved (or checked twice, once for overlay and one for SCTP, etc.) or not.

SCTP is the transport protocol used in WebRTC so not much of an edge case these days. Just about anyone running a multiplayer browser game, realtime chat or other similar server in a container is going to run into this. I think it makes sense to consider SCTP packet egress a baseline feature, so unless we can work around the kernel issue without it, IP_NF_MANGLE would have to be generally required.