Docker on a VPS: Why Published Ports Bypass ufw, and How to Secure Ports, the Socket and the API
Docker-published ports skip ufw rules and the docker group equals root. Bind to 127.0.0.1, use DOCKER-USER, protect the socket and consider rootless mode.