How to close access to Docker using UFW?

Question

ubuntu

There is a server on which docker is running, listening on port 4321. There is a goal: to prohibit access to docker from outside.
For this I use UFW.
Settings result:
$ ufw status verbose

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), allow (routed)
New profiles: skip
To Action From
-- ------ ----
80 ALLOW IN Anywhere
22 ALLOW IN Anywhere
4321 DENY IN Anywhere
80 (v6) ALLOW IN Anywhere (v6)
22 (v6) ALLOW IN Anywhere (v6)
4321 (v6) DENY IN Anywhere (v6)

But docker can still be reached from the outside through port 4321.

Answer 1

No, not even through iptables. Docker can only restrict access by itself. Use the --network=host directive when starting the container so that it forwards ports not to the default bridge network, but only to a host that is not accessible from the outside.