Q: You set up a strict UFW (Uncomplicated Firewall) on your Ubuntu server to block all incoming traffic to port 8080. You then run a Docker container `docker run -p 8080:80 myapp`. Miraculously, a hacker easily accesses your app on port 8080 from the internet. Why did the firewall fail?

Docker bypasses UFW by design. When Docker starts, it actively manipulates the Linux iptables directly by inserting its own rules at the absolute top of the PREROUTING chain in the nat table (in a chain called DOCKER). Because UFW operates primarily in the INPUT chain, the traffic hitting port 8080 is intercepted by Docker's PREROUTING rule *before* UFW ever sees it, and routed directly into the container. *Fix:* Never rely on host OS firewalls to protect exposed Docker ports. You must either not publish the port 8080 to the internet (bind it to localhost -p 127.0.0.1:8080:80), or modify the Docker daemon configuration to set "iptables": false (which breaks many standard Docker networking features).