Your ufw rules don't cover your Docker ports (and the log-rotation setting to make before your first container)
Two things bite almost every new Docker host in a homelab. One is a security surprise. The other is a disk that fills up a few weeks later. Both are a five-minute fix if you do them before the first real container. The firewall surprise Docker's own documentation on packet filtering says it plainly: Docker and ufw are incompatible. When you publish a container's port, Docker routes the traffic in…
New Docker hosts often encounter two common issues for first-time users. The first is a security inconvenience, while the second is an unexpected disk space problem. Both can be resolved quickly if addressed before deploying actual containers. Docker's documentation makes it clear that its built-in firewall, ufw, does not work with published container ports.
When you expose a container's port, Docker routes the traffic through its NAT table, bypassing ufw's INPUT chain. Consequently, a simple "deny all" rule won't catch incoming traffic. To avoid this, publish as few container ports as possible. On a well-designed Docker host, only the reverse proxy should publish ports (typically 80 and 443).
All other containers should be accessed through the proxy on an internal Docker network without specifying ports. To access admin tools that need to publish a port, use "127.0.0.1:9000:9000" and connect via an SSH tunnel. Another recommended approach is to set network rules at the router level, and employ Docker's DOCKER-USER chain for container-specific traffic.
Docker's default logging driver, json-file, does not perform any log rotation, which can lead to disk space exhaustion. Docker suggests using either the local driver or rotation options for json-file. These settings should be specified in /etc/docker/daemon.json. For example, setting "log-driver" to "json-file" and "log-opts" with "max-size" of "10m" and "max-file" of "3" limits log file growth.
After making changes to daemon.json, restart Docker using "sudo systemctl restart docker" and confirm the logging driver with "docker info --format '{{.LoggingDriver}}'". A frequent mistake is assuming old containers will automatically pick up the new logging configuration, which they won't. They must be recreated with the updated settings.
Regarding Docker permissions, the post-install documentation cautions that adding users to the docker group grants them root-level privileges, allowing them to mount the entire host filesystem. For a single-admin homelab setup, this is generally fine, but avoid adding service accounts or shared logins to the docker group. If tools need to access /var/run/docker.sock, mount it read-only where necessary and only allow trusted applications to interact with it.
In summary, to prevent common issues when starting with Docker, publish minimal container ports, bind admin tools to localhost or proxy networks, configure router-level access controls, set up log rotation in /etc/docker/daemon.json, and maintain strict control over the docker group permissions.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
