Right up until someone runs a container with 8080:8080, which unfortunately bypasses ufw and the container is suddenly exposed to the entire internet .. :|
People are getting hacked a lot because of this, and docker doesn't seem to care all that much.