Because rkt pod runs after plugin.SetUpPod() is called, so getRunningPods() does not return the newly created pod, which causes the hostport iptable rules to be missing for this new pod.