[janci]

It also bypasses firewall (ufw on ubuntu)

[rzzzt]

Yes and no, it's modifying the NAT table and so traffic will not be subjected to inbound rules where you would normally add an "allow HTTPS"-style rule: https://docs.docker.com/engine/network/packet-filtering-fire...

[diggan]

In what way is that "No"? The docs say:

> Docker routes container traffic in the nat table, which means that packets are diverted before it reaches the INPUT and OUTPUT chains that ufw uses. Packets are routed before the firewall rules can be applied, effectively ignoring your firewall configuration.

So docker is "effectively" ignoring your firewall in the case of ufw. I don't see how it can be considered to not ignoring your firewall when it ignores the rules you've setup.