Why Docker bypasses UFW and how to actually lock it down

I exposed a Postgres container to the public internet. Again. Same mistake, third time in maybe two years. The firewall was on, ufw status looked clean, and I still woke up to a flood of login attempts from IPs I'd never heard of. If you've ever run ufw deny 5432 and assumed your database was safe b