> It does not bypasses them, it uses the firewall to add forwarding rules to the container.

... yes, it adds a forwarding rule. Which skips over the rest of my firewall rules. One might even say that it bypasses them.

> By enabling port forwarding and exposing, you're essentially asking docker to configure the host for it.

No, I'm asking docker to listen on that port and pass it through to the container. If I tell nginx to listen on port 80, would you expect it to take that as a "do anything you can to make sure you get port 80, including rewriting the firewall tables to ignore the rule that blocks port 80"?