Docker spawns a docker-proxy application whenever you run a docker container. The application is responsible to proxy ports between the host machine and the container. I’m not sure when but newer versions of Linux Kernel support a special network flag that makes docker-proxy obsolete.

In order to save memory and CPU you must run docker daemon setting the flag --userland-proxy=false.

DOCKER_OPTS="--userland-proxy=false"