Move per-container forward rules to DOCKER chain

Closes #6034

Docker-DCO-1.1-Signed-off-by: Ian Bishop <ianbishop@pace7.com> (github: porjo)
It is little confusing that you create `chain` at beginning and fill fields here. I think you should use `chain := ` right here.