Q: Your security team configured Ubuntu UFW to block external access to port 5432, intending PostgreSQL to be accessible only from internal private IPs. An engineer launches a PostgreSQL container with `docker run -p 5432:5432 postgres`. An external vulnerability scan discovers that port 5432 is publicly exposed to the entire internet! SREs attempted setting `"iptables": false` in `/etc/docker/daemon.json`, which broke all container outbound internet access and DNS resolution. You must fix the firewall bypass properly using Docker's native `DOCKER-USER` iptables chain.

UFW and firewalld manage the `INPUT` chain. However, Docker published ports are routed through the iptables `PREROUTING` NAT table directly into the `FORWARD` chain, completely bypassing the `INPUT` chain where UFW rules reside.

<!-- Linux Kernel Packet Filtering Flow -->
Incoming Packet on Port 5432
  │
  ├──> PREROUTING (Docker DNAT translates host IP:5432 to container IP:5432)
  │
  ├──> FORWARD Chain  <=== DOCKER RULES LIVE HERE (UFW default allows forwarded packets!)
  │      │
  │      └───> Container Receives Packet! (UFW INPUT chain was completely bypassed!)
  │
  └──> INPUT Chain   <=== UFW Rules Live Here (Never evaluated for forwarded traffic!)

Setting `"iptables": false` in `daemon.json` prevents Docker from modifying iptables. However, this also disables Docker's outbound NAT (MASQUERADE) and bridge routing rules, causing containers to lose internet connectivity, DNS resolution, and container-to-container communication unless hundreds of manual iptables rules are maintained.

# daemon.json anti-pattern:
# { "iptables": false }  <-- Breaks outbound NAT and container networking!

Docker reserves the `DOCKER-USER` iptables chain specifically for user-defined firewall rules. The `DOCKER-USER` chain is evaluated before any Docker-generated forwarding rules. Insert rules here to restrict access to trusted subnets.

# Flush existing custom rules
sudo iptables -F DOCKER-USER

# Allow established and related connections
sudo iptables -A DOCKER-USER -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# Allow port 5432 only from trusted internal subnet (10.0.0.0/16)
sudo iptables -A DOCKER-USER -p tcp -s 10.0.0.0/16 --dport 5432 -j ACCEPT

# Drop all other external traffic to port 5432
sudo iptables -A DOCKER-USER -p tcp --dport 5432 -j DROP

# Return other traffic to Docker default chains
sudo iptables -A DOCKER-USER -j RETURN

For maximum safety at launch time, explicitly bind published ports to `127.0.0.1` or the specific private network interface IP rather than the default wildcard `0.0.0.0`.

# Bind to localhost only
docker run -d -p 127.0.0.1:5432:5432 postgres:16

# Or bind to private VPC interface
docker run -d -p 10.0.1.50:5432:5432 postgres:16