Binding a published port to localhost, because UFW will not save you

Docker writes its own iptables rules ahead of the chain UFW manages, so a published port is reachable from the internet regardless of what the firewall says.

# reachable from anywhere. the firewall is not consulted.
ports: ['3306:3306']

# reachable from the host only
ports: ['127.0.0.1:3306:3306']

# and the check that is worth doing from outside
# nmap -Pn -p 3306 your-server

The prefix is the reliable answer and it is one change per service. The alternative — rules in the DOCKER-USER chain, which is evaluated first — works and is fiddly enough that people get it wrong under pressure. This surprises almost everyone once, usually by exposing a database that the firewall was believed to be protecting, and the only trustworthy verification is a port scan from a machine that is not the server.