<![CDATA[Network Function Virtualization (NFV) and Service Function Chaining (SFC) enable network functions to be deployed as Virtual Network Functions (VNFs) on flexible commodity servers. However, chaining multiple VNFs within a service chain may degrade data-plane performance, particularly in container-based environments. This study analyzes the performance of container-based SFC in a single-host Docker environment under three scenarios: (1) a direct client–server connection without VNFs (baseline), (2) the addition of a single Layer 3 (L3) VNF in the form of an iptables firewall, and (3) the integration of an L3 firewall VNF combined with a Layer 4 (L4) load balancer VNF based on HAProxy. Performance evaluation was conducted by measuring TCP throughput using iperf3, end-to-end latency using ping, and CPU utilization of each container using docker stats. The results indicate that adding the L3 firewall reduces throughput by approximately 33% and nearly doubles latency compared to the baseline. Meanwhile, incorporating the L4 load balancer causes throughput degradation of up to 92%. CPU utilization analysis shows that the kernel-space firewall introduces minimal additional overhead in user space, whereas the L4 VNF becomes the primary source of CPU saturation. These findings suggest that, in container-based SFC deployments on a single-host Docker environment, performance bottlenecks are primarily driven by user-space L4 VNFs rather than kernel-based L3 forwarding. Therefore, L4 VNFs require special consideration when designing service chaining architectures for resource-constrained edge nodes.]]>
