How does Docker route external traffic into a container?

Publishing a port (-p hostPort:containerPort) causes Docker to install an iptables DNAT (destination NAT) rule on the host. Traffic arriving at the host's published port is rewritten to target the container's internal IP and port on its bridge network, then delivered across the virtual ethernet (veth) pair into the container's network namespace.