https://www.reddit.com/r/selfhosted/comments/ocqg1j/psa_docker_bypasses_ufw/ - notice this also when researching using docer and ufw to configure firewall rules - "You can avoid all this trouble by simply mapping to 127.0.0.1:[port]. You should always do this in general, don't expect ufw to handle all of your defense. Keep stuff that should be private listening only on localhost."