You set up UFW, allowed only SSH, 80 and 443, and ran ufw status to check. Then you started a container with -p 8080:80 , and port 8080 is open to the whole internet anyway.

This isn't a bug in your UFW rules. It's how Docker networking works on iptables-based hosts, which is still the default. Here's why it happens, how to check your own server, and three ways to fix it.

Why UFW doesn't see container ports

UFW mostly manages the INPUT chain: traffic addressed to the host itself.

When you publish a port, Docker adds a NAT rule that rewrites incoming traffic for host:8080 to the container's IP and port. After that rewrite, the packet isn't for the host any more. It's forwarded to the container, so it goes through the FORWARD chain, where Docker's own rules accept it.…