What I use is tinc to create a kind of a private subnet between all my docker hosts and then only listen with internal dockers on internal ips, ufw rules don't

What I use is tinc to create a kind of a private subnet between all my docker hosts and then only listen with internal dockers on internal ips, ufw rules don't apply to docker networks, docker messes with the iptables directly.