ufw-docker is a firewall management tool that resolves the security conflict between UFW and Docker without disabling iptables.
Docker publishes container ports by inserting iptables rules that bypass UFW's firewall policies, creating a serious security vulnerability. When UFW is enabled on a server with Docker installed, ports published with the `-p` flag become accessible from external networks even when UFW rules explicitly deny them. This happens because Docker manages its own iptables chains independently of UFW, and the standard solution of disabling Docker's iptables function breaks container-to-external-network connectivity and requires manual rule management for each custom Docker network. The tool addresses this by providing a mechanism to enforce UFW rules on Docker-published ports while preserving Docker's network management capabilities and iptables functionality.
This tool is essential for anyone running Docker on Ubuntu or Debian systems with UFW enabled who needs to expose services selectively while maintaining firewall security. It suits deployments where firewall rules must be enforced consistently across both host and container traffic, and where disabling Docker's iptables management is not acceptable. The project acknowledges that existing solutions found online are inelegant and typically require either sacrificing Docker's networking features or manually maintaining iptables rules for each Docker network.
The project shows consistent maintenance with shell script improvements and bug fixes applied over time. The tool receives updates addressing edge cases and compatibility issues as they arise. Development activity demonstrates responsiveness to reported problems affecting UFW and Docker integration on Linux systems.
