docker-iptables-bypasses-ufw-docker-user-chain-required

Docker injects its own iptables rules that bypass UFW entirely — all 0.0.0.0-bound container ports are exposed to eth0 regardless of UFW deny rules. The DOCKER-USER chain must be explicitly populated: ACCEPT established/related, ACCEPT docker0/172.x, DROP INPUT from eth0. Rules must be persisted via iptables-persistent and re-applied after reinstall (reinstall auto-loads old rules file, wiping new rules).

Related

• researchclaw-must-run-in-dedicated-container-for-sandboxing
• researchclaw-dedicated-container-oracle-network-topology
• researchclaw-dedicated-container-isolation-requirement
• researchclaw-dedicated-container-not-inside-hermes
• traefik-multi-network-container-needs-explicit-network-label
• docker-iptables-bypasses-ufw-requires-docker-user-chain
• hostinger-cloud-firewall-is-upstream-gate-not-ufw
• hostinger-cloud-firewall-is-upstream-gate-docker-bindings-no