Docker bypasses UFW firewall rules, exposing container ports to local networks

A technical investigation has revealed that Docker silently overrides UFW firewall rules on Linux systems, including Raspberry Pi OS, by injecting its own iptables chains ahead of UFW's in the packet-filtering order. When a container port is published, Docker applies a DNAT rule that redirects traffic to the container before UFW's rules are ever evaluated, making the port reachable across the local network despite UFW showing it as blocked. The same port blocked for a host process becomes fully accessible when served from a container, yet UFW's status output shows no difference between the two scenarios. This occurs because Docker documents its iptables manipulation as intended behavior, but UFW's status tool only reflects its own rules and cannot account for Docker's parallel routing. Users can mitigate the exposure by binding container ports explicitly to 127.0.0.1 or by adding blocking rules directly to Docker's DOCKER-USER chain.