Hardening a VPS with Codex? Docker ports skip ufw, so have it lock the firewall and keep public SSH until Tailscale works

#What changed

Vox (@Voxyz_ai) posted a server-hardening prompt on Oct 24 that drew about 61,000 views and 950 bookmarks in under a day. The point behind it: on a VPS running Docker, a ufw firewall doesn't protect the ports your containers publish. Docker's own documentation confirms this. Docker routes published-port traffic in the iptables nat table, so packets are diverted before they reach the INPUT and OUTPUT chains ufw uses, which in effect ignores your ufw rules. Vox also argues key-only SSH isn't enough on its own, because a bug in sshd itself can still let attackers in. The prompt, run on the server in Codex or Claude Code, asks the agent to first confirm the domain is proxied through Cloudflare and serving HTTPS on 443, then install Tailscale and join the tailnet, allow 443 only from Cloudflare's IP ranges and port 22 only from Tailscale, close everything else including Docker-published ports, keep public SSH open until you confirm a Tailscale login, and finish by showing how to verify the result from outside.

#Who is affected

Anyone self-hosting a side project, API or agent on a VPS with Docker (Compose stacks especially) who assumed ufw deny was keeping those ports private. It matters most if the domain already sits behind Cloudflare's proxy, since that's what the prompt assumes.

#What to do now

• Run the agent in a session where every command needs your approval, not full auto. You're handing it root and your firewall.
• Keep a provider console or VNC path open the whole time. Don't let it close public SSH until a second shell over Tailscale works from another device and Tailscale shows the server online, as several replies stressed.
• Ask it to bind published ports to 127.0.0.1 (or the Tailscale IP) in your compose file instead of 0.0.0.0, or to filter in the DOCKER-USER chain. Rules in plain ufw won't catch Docker traffic.
• Cloudflare's IP list changes over time. Have Codex set up a scheduled refresh from cloudflare.com/ips instead of pasting the ranges once.
• Finish with an outside port scan from another network, not just the agent's say-so.

#What is not confirmed

The Docker and ufw behavior is documented by Docker. The full prompt is a community recipe, not an OpenAI or Codex feature, and DotsFeed hasn't run it end to end. Results depend on your provider, firewall backend (iptables or nftables) and Docker setup.