# Docker

# How to use UFW with Docker // ufw-docker

## Why you need it

Docker publishes ports by inserting its own iptables rules before UFW can see them.
A normal `ufw deny 8080` does nothing.
`ufw-docker` fixes this by making Docker traffic go through UFW’s rules.

## PrerequisitesUbuntu / Debian (or any distro with UFW)
Docker already installed and working
UFW preferably already enabled

Make sure Docker’s iptables management is enabled (default):

```
# Check (should NOT have "iptables": false)
cat /etc/docker/daemon.json
```

##. Install ufw-docker

```
# Download the script
sudo wget -O /usr/local/bin/ufw-docker \
  https://github.com/chaifeng/ufw-docker/raw/master/ufw-docker

# Make it executable
sudo chmod +x /usr/local/bin/ufw-docker
```

Install the necessary UFW rules:

```
sudo ufw-docker install
```

This backs up `/etc/ufw/after.rules` and adds the required Docker-aware rules.
Reload UFW:
```
sudo ufw reload
# or
sudo systemctl restart ufw
```

(Optional but recommended) Install the systemd service so rules stay updated:

```
sudo ufw-docker install-service
```

## Basic UFW setup

```
# Set defaults
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Always allow SSH (change port if needed)
sudo ufw allow 22/tcp
# or: sudo ufw allow 2222/tcp

# Enable UFW
sudo ufw enable
```

## How to allow / deny Docker containers

**Important concept:**

You allow the container port, not the host port.   
Example:

```
docker run -d --name web -p 8080:80 nginx
```

→ You allow port 80 (the container’s port).

### Allow a container

```
# Allow all published ports of the container
sudo ufw-docker allow web

# Allow only a specific port
sudo ufw-docker allow web 80
sudo ufw-docker allow web 80/tcp
sudo ufw-docker allow web 53/udp
```

### Allow only from a specific IP / network

```
sudo ufw-docker allow web 80 from 203.0.113.50
sudo ufw-docker allow web 80 from 192.168.1.0/24
```

### Delete rules

```
# Remove all rules for the container
sudo ufw-docker delete allow web

# Remove a specific port
sudo ufw-docker delete allow web 80
```

### Useful commands

```
ufw-docker status          # Show current Docker-related rules
ufw-docker list web        # Show rules for a specific container
ufw-docker check           # Verify installation
ufw-docker help            # Full help
```