{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/test-published-docker-ports-beyond-the-host-ufw-rule-list/", "item": { "id": "https://update.dsesecurity.com/updates/test-published-docker-ports-beyond-the-host-ufw-rule-list/", "slug": "test-published-docker-ports-beyond-the-host-ufw-rule-list", "url": "https://update.dsesecurity.com/updates/test-published-docker-ports-beyond-the-host-ufw-rule-list/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/test-published-docker-ports-beyond-the-host-ufw-rule-list.md", "json": "https://update.dsesecurity.com/api/v1/posts/test-published-docker-ports-beyond-the-host-ufw-rule-list/" }, "title": "Test published Docker ports beyond the host ufw rule list", "summary": "An apparently restrictive ufw policy may not describe the path taken by container traffic.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:15:14+00:00", "modified_at": "2026-10-20T18:34:32+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 261, "potentially_affected": "Review Docker-published traffic through the Linux packet-filtering path described in the ufw guidance.", "dse_recommendation": "DSE recommends inventorying published addresses and ports and testing reachability from the relevant external network.", "primary_source": { "name": "Docker documentation — Packet filtering and firewalls", "url": "https://docs.docker.com/engine/network/packet-filtering-firewalls/", "published_on": null, "authority": "docs.docker.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

An apparently restrictive ufw policy may not describe the path taken by container traffic.

\n

Source facts

\n

Docker documents that published container traffic is diverted through its networking rules before reaching the INPUT and OUTPUT chains used by ufw. Consequently, ufw rules can be effectively bypassed for that path. Docker also warns against disabling its rule management without suitable replacement, because container networking relies on those rules.

\n

Source: Docker documentation — Packet filtering and firewalls.

\n

Applicability

\n

Review Docker-published traffic through the Linux packet-filtering path described in the ufw guidance.

\n

DSE recommendation

\n

DSE recommends inventorying published addresses and ports and testing reachability from the relevant external network. Keep host-service exposure and container-published exposure as separate review items. Use the supported Docker filtering mechanism for the installed backend rather than assuming an ordinary host rule automatically protects every published listener. Do not disable Docker networking controls as a quick hardening step without a complete replacement design. Record the expected allowed and denied paths with the application owner before changing a production port mapping.

\n

Verification

\n

On an approved test host, compare a host listener and a published container port from both allowed and denied source locations. Inspect the effective forwarding path without disrupting unrelated rules. Confirm the final policy is enforced by observed reachability, not solely by the appearance of a ufw status display. Retain the published bind address, protocol and source location with every observation. Have the network owner reconcile an unexpectedly reachable port with the actual forwarding rules before approving the final exposure inventory.

\n

Official reference

\n

Docker documentation — Packet filtering and firewalls. Reviewed October 20, 2026.

", "content_text": "An apparently restrictive ufw policy may not describe the path taken by container traffic.\nSource facts\nDocker documents that published container traffic is diverted through its networking rules before reaching the INPUT and OUTPUT chains used by ufw. Consequently, ufw rules can be effectively bypassed for that path. Docker also warns against disabling its rule management without suitable replacement, because container networking relies on those rules.\nSource: Docker documentation — Packet filtering and firewalls.\nApplicability\nReview Docker-published traffic through the Linux packet-filtering path described in the ufw guidance.\nDSE recommendation\nDSE recommends inventorying published addresses and ports and testing reachability from the relevant external network. Keep host-service exposure and container-published exposure as separate review items. Use the supported Docker filtering mechanism for the installed backend rather than assuming an ordinary host rule automatically protects every published listener. Do not disable Docker networking controls as a quick hardening step without a complete replacement design. Record the expected allowed and denied paths with the application owner before changing a production port mapping.\nVerification\nOn an approved test host, compare a host listener and a published container port from both allowed and denied source locations. Inspect the effective forwarding path without disrupting unrelated rules. Confirm the final policy is enforced by observed reachability, not solely by the appearance of a ufw status display. Retain the published bind address, protocol and source location with every observation. Have the network owner reconcile an unexpectedly reachable port with the actual forwarding rules before approving the final exposure inventory.\nOfficial reference\nDocker documentation — Packet filtering and firewalls. Reviewed October 20, 2026.", "content_markdown": "An apparently restrictive ufw policy may not describe the path taken by container traffic.\n\n## Source facts\n\nDocker documents that published container traffic is diverted through its networking rules before reaching the INPUT and OUTPUT chains used by ufw. Consequently, ufw rules can be effectively bypassed for that path. Docker also warns against disabling its rule management without suitable replacement, because container networking relies on those rules.\n\nSource: [Docker documentation — Packet filtering and firewalls](https://docs.docker.com/engine/network/packet-filtering-firewalls/).\n\n## Applicability\n\nReview Docker-published traffic through the Linux packet-filtering path described in the ufw guidance.\n\n## DSE recommendation\n\nDSE recommends inventorying published addresses and ports and testing reachability from the relevant external network. Keep host-service exposure and container-published exposure as separate review items. Use the supported Docker filtering mechanism for the installed backend rather than assuming an ordinary host rule automatically protects every published listener. Do not disable Docker networking controls as a quick hardening step without a complete replacement design. Record the expected allowed and denied paths with the application owner before changing a production port mapping.\n\n## Verification\n\nOn an approved test host, compare a host listener and a published container port from both allowed and denied source locations. Inspect the effective forwarding path without disrupting unrelated rules. Confirm the final policy is enforced by observed reachability, not solely by the appearance of a ufw status display. Retain the published bind address, protocol and source location with every observation. Have the network owner reconcile an unexpectedly reachable port with the actual forwarding rules before approving the final exposure inventory.\n\n## Official reference\n\n[Docker documentation — Packet filtering and firewalls](https://docs.docker.com/engine/network/packet-filtering-firewalls/). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/test-published-docker-ports-beyond-the-host-ufw-rule-list/", "url": "https://update.dsesecurity.com/updates/test-published-docker-ports-beyond-the-host-ufw-rule-list/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/test-published-docker-ports-beyond-the-host-ufw-rule-list/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "IT", "item": "https://update.dsesecurity.com/topic/it/" }, { "@type": "ListItem", "position": 3, "name": "Test published Docker ports beyond the host ufw rule list", "item": "https://update.dsesecurity.com/updates/test-published-docker-ports-beyond-the-host-ufw-rule-list/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/test-published-docker-ports-beyond-the-host-ufw-rule-list/#article", "identifier": "https://update.dsesecurity.com/updates/test-published-docker-ports-beyond-the-host-ufw-rule-list/", "url": "https://update.dsesecurity.com/updates/test-published-docker-ports-beyond-the-host-ufw-rule-list/", "headline": "Test published Docker ports beyond the host ufw rule list", "description": "An apparently restrictive ufw policy may not describe the path taken by container traffic.", "abstract": "An apparently restrictive ufw policy may not describe the path taken by container traffic.", "articleBody": "An apparently restrictive ufw policy may not describe the path taken by container traffic.\nSource facts\nDocker documents that published container traffic is diverted through its networking rules before reaching the INPUT and OUTPUT chains used by ufw. Consequently, ufw rules can be effectively bypassed for that path. Docker also warns against disabling its rule management without suitable replacement, because container networking relies on those rules.\nSource: Docker documentation — Packet filtering and firewalls.\nApplicability\nReview Docker-published traffic through the Linux packet-filtering path described in the ufw guidance.\nDSE recommendation\nDSE recommends inventorying published addresses and ports and testing reachability from the relevant external network. Keep host-service exposure and container-published exposure as separate review items. Use the supported Docker filtering mechanism for the installed backend rather than assuming an ordinary host rule automatically protects every published listener. Do not disable Docker networking controls as a quick hardening step without a complete replacement design. Record the expected allowed and denied paths with the application owner before changing a production port mapping.\nVerification\nOn an approved test host, compare a host listener and a published container port from both allowed and denied source locations. Inspect the effective forwarding path without disrupting unrelated rules. Confirm the final policy is enforced by observed reachability, not solely by the appearance of a ufw status display. Retain the published bind address, protocol and source location with every observation. Have the network owner reconcile an unexpectedly reachable port with the actual forwarding rules before approving the final exposure inventory.\nOfficial reference\nDocker documentation — Packet filtering and firewalls. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:15:14+00:00", "dateModified": "2026-10-20T18:34:32+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/test-published-docker-ports-beyond-the-host-ufw-rule-list/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/test-published-docker-ports-beyond-the-host-ufw-rule-list/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Test published Docker ports beyond the host ufw rule list" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 261, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Docker documentation — Packet filtering and firewalls", "url": "https://docs.docker.com/engine/network/packet-filtering-firewalls/" } } ] } }