anchor.diff:      port=$(echo $portproto | cut -d'/' -f1)
       proto=$(echo $portproto | cut -d'/' -f2)
         while read rule; do
  -        #todo: parse ip as "-d (\d.\d.\d.\d)
  -        #if ip != $containerip, drop it
  -           #Match first IP from the rule
  -        ruleip=$(echo $rule | grep -oE '((1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])' | head -1)
  -        if [[ "$containerip" != "$ruleip" ]]; then
  -          iptables-save | grep -v $rule | iptables-restore
  +        #if rule ips do not contain $containerip, drop it
  +        ruleips=$(echo $rule | grep -oE '((1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])')
  +        if ! [[ "$ruleips" =~ "$containerip" ]]; then
  +          iptables-save | grep -v -- "$rule" | iptables-restore
           fi
         done < <(iptables-save | grep -- "-m $proto --dport $port")
     done
  
positive.code: 
    iptables -t nat -I POSTROUTING 1 -s "$NETWORK/$PREFIX" -p $proto -m $proto --dport $port -m comment --comment "$container-$proto-$port-unmasquerade" -j ACCEPT
    iptables -A FORWARD -i $admin_interface -o docker0 -m state --state NEW -p $proto  -m $proto --dport $port -m comment --comment "$container-$proto-$port-accept" -j ACCEPT
    service iptables save
  }
  function purge_stale_iptables_rules {
    container=$1
  
negative.code:   case $1 in
      cobbler)   setup_dhcrelay_for_cobbler
                 ;;
      nginx)     remangle_nginx
                 ;;
      rsyslog)   remangle_syslog
                 ;;
      *)         ;;
    esac
  }
  