Why Docker bypasses UFW and how to actually lock it down

I exposed a Postgres container to the public internet. Again. Same mistake, third time in maybe two years. The firewall was on, ufw status looked clean, and I still woke up to a flood of login attempts from IPs I'd never heard of. If you've ever run ufw deny 5432 and assumed your database was safe behind a Docker container, this post is for you. I'm writing it mostly so future-me stops repeating the same mistake. The setup that bit me Here's the classic scenario. You've got a VPS. You install UF