Docker bypasses ufw rules, and logs need rotation before your first container

Docker publishes container ports through the nat table, which runs before the INPUT chain ufw relies on, so a default-deny ufw policy does not block them. The article recommends publishing only a reverse proxy's ports (80 and 443), binding any admin ports to 127.0.0.1 and reaching them through an SSH tunnel, and filtering traffic at the network edge or in the DOCKER-USER chain. It also explains that Docker's default json-file logging does no rotation, so a chatty container can fill the disk, and shows how to set max-size and max-file in /etc/docker/daemon.json. Those settings apply only to newly created containers, so existing ones must be recreated. Finally, it warns that membership in the docker group grants root-level host access and should be limited to trusted admins.