The docker part bit me in the behind as well, had absolutely no idea it would circumvent ufw by design.

Angry at myself for not reading the docs carefully but who has time for that? :/