Docker Bypasses UFW: Your Firewalled Database Is Probably Public. Here's the Fix

When you run Docker with the command `docker run -p 5432:5432 postgres`, your Postgres database becomes accessible from the entire internet. Despite UFW (Uncomplicated Firewall) blocking incoming traffic, Docker bypasses UFW's rules. This issue has been present since at least 2014, and the fix is a simple one-line change that many people are unaware of. Docker's behavior of overriding UFW rules has been criticized, as it can lead to public exposure of services without the user's knowledge.

To check if your Docker ports are publicly accessible, use the command `docker ps --format {{.Names}}\t{{.Ports}} | grep -E 0.0.0.0|\[::\]|:::`. Any line showing public IP addresses or IPv6 addresses indicates that the container is accessible from the outside. Performing the check from a machine outside your network is crucial, as `ufw status` only shows UFW's own rules.

The most straightforward solution is to bind the published port to the loopback address using `-p 127.0.0.1:5432:5432 postgres` (or `[::1]:5432:5432` for IPv6). This ensures that the database is only accessible from within the Docker host itself. In a Docker Compose file, you can achieve the same by specifying `ports: ["127.0.0.1:5432:5432"]` or omitting the `ports` section altogether if the application is on the same network and can reach the database by service name.

For persistent solutions, modify the Docker daemon configuration by adding `ip: "127.0.0.1"` and `default-network-opts: {"bridge": {"com.docker.network.bridge.host_binding_ipv4": "127.0.0.1"}}` in `/etc/docker/daemon.json`. Restart the Docker daemon for the changes to take effect. Alternatively, you can use the `DOCKER-USER` chain to filter traffic based on specific rules, such as restricting access to a particular subnet. This approach can be combined with `ufw-docker` for finer-grained control.