iptables vs nftables on Ubuntu
On Ubuntu the iptables command already writes nftables rules. Prove it on your box, read the native ruleset, and see where ufw and Docker collide.
#iptables
Filtering by topic #iptables · clear
Docker bypasses UFW: why and how to fix it
Docker publishes container ports with iptables rules that skip UFW, so a denied port still answers the internet. See the mechanism and the fixes that work.