Just to clarify: if you "sudo ufw deny 80" and than run a docker container on 80 port, your 80 port would remain inaccessible (as per ufw rules)?

Even rootless docker usually pierce through that. Might be some setting in a podman, thought, never really worked with that.