Let me start off by saying yes it's awful that Docker is inserted at the top of the chain. This is a legacy that we'll have to work around to make work with exi

Let me start off by saying yes it's awful that Docker is inserted at the top of the chain. This is a legacy that we'll have to work around to make work with existing rules. However, UFW is an awful iptables citizen as it assumes it is the sole owner of iptables. In general Docker does try to be a good iptables citizen and generally assume that it's not the only thing doing iptables work. The existing behavior where docker sits above everything else in iptables is unfortunate but has been around since forever and is not easy to change without breaking lots of existing installations. Please take a look at https://github.com/docker/libnetwork/pull/1675 https://github.com/docker/libnetwork/pull/1675 as at least a partial solution to this.