Stock docker puts entries in your iptables which usually fully bypasses your firewall. try installing docker on stock Ubuntu, run a container with an exposed port, put ifw up blocking all traffic, and the container is still going to be reachable.

That's not voodoo, that's perfectly reasonable behaviour.

Why are you wasting time with ipfw?