Only ensure chains if not container :)

iptables/rules.sls

@@ -2,6 +2,7 @@
 
 {%- for chain_name, chain in service.get('chain', {}).iteritems() %}
 
+{%- if grains.get('virtual_subtype', None) not in ['Docker', 'LXC'] %}
 iptables_{{ chain_name }}:
   iptables.chain_present:
     - family: ipv4
@@ -23,6 +24,7 @@ iptables_{{ chain_name }}_ipv6:
       - iptables: iptables_{{ chain_name }}_ipv6_policy
 {%-     endif  %}
 {%-   endif %}
+{%- endif %}
 
 {%- if chain.policy is defined %}
 iptables_{{ chain_name }}_policy: