title: What is the best practice of docker + ufw under Ubuntu
body: <p>I just tried out Docker. It is awesome but seems not work nicely with ufw. By default, docker will manipulate the iptables a little bit. The outcome is not a bug but not what I expected.
  For more details you can read <a href="http://blog.viktorpetersson.com/post/101707677489/the-dangers-of-ufw-docker" rel="noreferrer">The dangers of UFW + Docker</a></p>
  <p>My goal is to set up a system like</p>
  <pre><code>    Host (running ufw) -&gt; docker container 1 - nginx (as a reverse proxy)
                         -&gt; docker container 2 - node web 1
                         -&gt; docker container 3 - node web 2
                         -&gt; .......
  </code></pre>
  <p>I want to manage the incoming traffic (e.g. restrict access) through ufw therefore I don't want docker to touch my iptables. Here is my test</p>
  <p><strong>Environment:</strong></p>
  <ul>
  <li>a newly installed Ubuntu 14.04 (kernel: 3.13.0-53 )</li>
  <li>Docker 1.6.2</li>
  <li>ufw forwarding is enabled.( [Enable UFW forwarding] <a href="https://docs.docker.com/installation/ubuntulinux/#enable-ufw-forwarding" rel="noreferrer" title="Enable UFW forwarding">2</a> )</li>
  <li><code>--iptables=false</code> was added to the Docker daemon.</li>
  </ul>
  <p><strong>First Attempt</strong></p>
  <pre><code>docker run --name ghost -v /home/xxxx/ghost_content:/var/lib/ghost -d ghost
  docker run --name nginx -p 80:80 -v /home/xxxx/nginx_site_enable:/etc/nginx/conf.d:ro --link ghost:ghost -d nginx
  </code></pre>
  <p>No luck. The first command is fine but the second command will throw an error</p>
  <pre><code>Error response from daemon: Cannot start container
  </code></pre>
  <p><strong>Second Attempt</strong></p>
  <p>Then I found this: <a href="https://github.com/docker/docker/issues/12701" rel="noreferrer">unable to link containers with --iptables=false #12701</a></p>
  <p>After running the following command, everything looks OK.</p>
  <pre><code>sudo iptables -N DOCKER
  </code></pre>
  <p>However, I noticed that I can not establish any outbound connections inside containers. For example:</p>
  <pre><code>xxxxg@ubuntu:~$ sudo docker exec -t -i nginx /bin/bash
  root@b0d33f22d3f4:/# ping 74.125.21.147
  PING 74.125.21.147 (74.125.21.147): 56 data bytes
  ^C--- 74.125.21.147 ping statistics ---
  35 packets transmitted, 0 packets received, 100% packet loss
  root@b0d33f22d3f4:/# 
  </code></pre>
  <p>If I remove <code>--iptables=false</code> from the Docker daemon, then the internet connection of containers will be back to normal but the ufw will not work 'properly'  (well...by my definition).</p>
  <p>So, what is the best practice of docker + ufw? Can anyone provide some help?</p>