Docker doesn’t do that on my Fedora machine, nor on my arch machine. Did I set some setting somewhere that I forgot about? I’m also running rootless docker and podman so that might explain.

Just to clarify: if you "sudo ufw deny 80" and than run a docker container on 80 port, your 80 port would remain inaccessible (as per ufw rules)?

Even rootless docker usually pierce through that. Might be some setting in a podman, thought, never really worked with that.