network router –> physical machine –> calico (router) –> container