The networkPolicy will block the traffic from a pod bearing the tier: backend label, to a pod bearing the tier:
frontend label. The networkPolicy specifies that only pods with the tier: frontend label can access the pods with the app: guestbook-api and tier: backend labels on port 801. Any other traffic to the backend pods will be denied by default2. Therefore, a request issued from a pod bearing the tier: backend label, to a pod bearing the tier: frontend label will be blocked by the networkPolicy. References: Connect a Frontend to a Backend Using Services), Network Policies)

= The command 'docker swarm nodes' is not a valid command to list all nodes in a swarm cluster from the command line. The correct command is docker node ls, which can be run on a manager node to view the details of all the nodes in the swarm1. The docker swarm command is used to manage the swarm itself, not the nodes. For example, you can use docker swarm init to create a new swarm, or docker swarm join to add a node to an existing swarm2. References:
* Manage nodes in a swarm | Docker Docs
* docker swarm | Docker Docs

= Seccomp is a Linux kernel feature that allows you to restrict the actions available within the container. By using a seccomp profile, you can limit the system calls that a container can make, thus enhancing its security and isolation. Docker has a default seccomp profile that blocks some potentially dangerous system calls, such as mount, reboot, or ptrace. You can also pass a custom seccomp profile for a container using the --security-opt option. Seccomp can limit a container's access to host resources, such as CPU or memory, by blocking or filtering system calls that affect those resources, such as setpriority, sched_setaffinity, or mlock. References:
* Seccomp security profiles for Docker
* Hardening Docker Container Using Seccomp Security Profile

The set of commands docker port inspect and docker container inspect will not identify the published port(s) for a container. The reason is that there is no such command as docker port inspect. The correct command to inspect the port mappings of a container is docker port1. The command docker container inspect can also show the port mappings of a container, but it will display a lot of other information as well, so it is not as concise as docker port2. To identify the published port(s) for a container, you can use either of these commands:
* docker port CONTAINER will list all the port mappings of the container1.
* docker port CONTAINER PRIVATE_PORT will list only the port mapping of the specified private port of the container1.
* docker container inspect --format=' { {.NetworkSettings.Ports}}' CONTAINER will list only the port
* mappings of the container in a JSON format23.
For example, if you have a container named web that publishes port 80 to port 8080 on the host, you can use any of these commands to identify the published port:
$ docker port web
80/tcp -> 0.0.0.0:8080
$ docker port web 80
0.0.0.0:8080
$ docker container inspect --format=' { {.NetworkSettings.Ports}}' web
map[80/tcp:[map[HostIp:0.0.0.0 HostPort:8080]]]
References:
* docker port
* docker container inspect
* How can I grab exposed port from inspecting docker container?