How does Docker implement published ports under the hood?

Through iptables DNAT (Destination NAT) rules on Linux, which rewrite incoming traffic on the published host port to be forwarded to the container's internal IP and port on the bridge network.