title: Why does Docker run so many processes to map ports though to my application?
body: <p>I have an application that runs in a container that requires a range of ports to be mapped to it. </p>
  
  <pre><code>docker run -p 2000-3000:2000-3000 myapp
  </code></pre>
  
  <p>When I run this docker command my development vm grinds to a halt.</p>
  
  <p>Then looking at the processes, there is a <code>docker-proxy</code> running for every port</p>
  
  <pre><code>$ ps -ef 
  ...
  root     19796  7835  0 03:31 ?        00:00:00 docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 4000 -container-ip 172.17.0.4 -container-port 3000
  root     19804  7835  0 03:31 ?        00:00:00 docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 3999 -container-ip 172.17.0.4 -container-port 2999
  root     19812  7835  0 03:31 ?        00:00:00 docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 3998 -container-ip 172.17.0.4 -container-port 2998
  ...
  
  $ ps -ef | grep -c docker-proxy
  1003
  </code></pre>
  
  <p>They are all children of the docker daemon</p>
  
  <pre><code>root@default-docker:~# pstree -p
  init(1)-+-VBoxService(1251)
          |-acpid(1277)
          |-crond(1235)
          |-docker(7835)-+-docker-containe(7841)-+-docker-containe(8031)---gitlab-ci-multi(8048)
          |              |                       |-docker-containe(9678)---mysqld(9693)
          |              |                       `-docker-containe(20577)---registry(20591)
          |              |-exe(19796)
          |              |-exe(19804)
          |              |-exe(19812)
  </code></pre>
  
  <p>Each process uses a chunk of private memory (<code>Pss</code> in <code>/proc/$pid/smaps</code>)</p>
  
  <pre><code>$ for pid in $(pgrep exe); do printf "pid:%5s mem:%5s\n" $pid $(awk '/^Pss:/{t=t+$2}END{print t}' /proc/$pid/smaps); done
  ...
  pid:28534 mem: 4011
  pid:28543 mem: 3817
  pid:28552 mem: 4001
  </code></pre>
  
  <p>There are also DNAT rules in place for each port, which is how I would have expected this to be done on a Linux host with private networks. </p>
  
  <pre><code>root@default-docker:~# iptables -t nat -vnL DOCKER
  Chain DOCKER (2 references)
   pkts bytes target     prot opt in     out     source               destination         
  ...
      0     0 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:4000 to:172.17.0.4:3000
      0     0 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:3999 to:172.17.0.4:2999
      0     0 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:3998 to:172.17.0.4:2998
  ...
  </code></pre>
  
  <p>Why is Docker launching a process per port?<br>
  Why does each process need 4-6MB of memory?<br>
  Why is Docker using a user space process at all?</p>