If you give NET_ADMIN to a container, it can do anything related to the NET_ADMIN capability. I stole the list from here: interface config, firewall config, routing table, bind to any address, set promiscuous mode, clear driver statistics, enable multicasting.
Each docker container gets its own network namespace, so generally any of these operations will be restricted to just the network namespace that the container is running in.
I am not familiar enough with all of the capabilities and the implications that each one has to be able to personally say that the NET_ADMIN capability does or doesn’t give a container breakout path or not.
Generally if you want to handle iptables-level stuff, you must accept the fact that you will need to do so with administrative privileges. It is a much lower attack surface to only give out the NET_ADMIN capability instead of going full superuser.