For some reason, Docker 1.9.1 no longer creates a chain in iptables; we used this to have dynamic port forwardings for a docker image with unpredictable ports (RabbitMQ). Because of the upgrade, we could no longer inject te dynamic ports into the chains, and the nodes no longer could discover the other members.

Fixed by reverting docker to 1.8.2 (including docker-compose).