Constant PUBLISHED_FROM_OUTSIDE 

pub const PUBLISHED_FROM_OUTSIDE: &str = r"cat > /etc/systemd/system/isoloom-published.service <<'UNIT'
[Unit]
Description=Isoloom: published ports reach containers of networks without a default route
After=docker.service
Wants=docker.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/sh -c 'iptables -t nat -C POSTROUTING -m conntrack --ctstate DNAT -o br-+ -j MASQUERADE 2>/dev/null || iptables -t nat -I POSTROUTING -m conntrack --ctstate DNAT -o br-+ -j MASQUERADE'

[Install]
WantedBy=multi-user.target
UNIT
systemctl daemon-reload
systemctl enable --now isoloom-published.service
";

On a Docker host VM, published ports reach containers whatever their routes: what arrives from outside the VM (a forward to this computer, a client of the server’s address) is DNAT’ed by Docker with its source kept, and a container of an internet: false network, its default route removed, can’t answer it. Masquerading that traffic into the lab’s bridges makes it come from the bridge’s own address, which every container reaches. A unit keeps the rule across reboots, after Docker’s own. Run as root; running it again changes nothing.