netfilter
Security
The packet filter built into the kernel: the tables, chains and rules every packet is matched against on its way in, out or through. It is not a program you run. ufw, iptables, nft and Docker all write into the same chains, and that is where the misunderstanding sits: ufw is one view of the firewall, not the firewall. ufw status reports the rules ufw itself wrote and no others. Docker publishes a port by writing straight into netfilter, in a chain reached ahead of anything ufw put in place: docker run -p 5432:5432 postgres leaves PostgreSQL reachable from the internet while ufw status still calls 5432 closed. Read the whole ruleset with sudo nft list ruleset or sudo iptables -S. And the fix is a prefix: -p 127.0.0.1:5432:5432.