Containers connected to a common bridge, for which you want to restrict traffic (between them). You have to do that at L2.