If you run ufw default deny incoming on a VPS and then docker run -p 5432:5432 postgres , your Postgres is reachable from the whole internet. UFW will still tell you everything is denied. Docker has bypassed UFW since at least 2014, and the fix is a one-line change most people never hear about.

This week's Docker is weird essay made the rounds on Hacker News and Lobsters . It's a fun tour of internals: containers are just processes, images are just folders, runc re-execs /proc/self/exe because Go can't fork. All of it is true and weird, and none of it will get your database dumped by a bot at 3am.

The weird default that will is buried in the comments. One HN commenter put it plainly: "Whats interesting and dangerous is how docker just overrides ufw rules like they do dont exist." On Lobsters, people were still arguing about whether containers are reachable from outside by default. They are, if you published the port.

My take: Docker's defaults are tuned for a five-minute demo on a laptop.…