Firewall

The firewall (ufw) is on: incoming connections are refused, outgoing allowed. Ubuntu’s defaults still let printer discovery (mDNS, SSDP) work.

The only open ports

KDE Connect, ports 1714–1764 (TCP and UDP), from private networks only — 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 — over IPv4.

sudo ufw status

Docker and Podman

• Docker publishes container ports on 127.0.0.1 by default: docker run -p 8080:80 … is reachable from this machine only. To expose a port to your network, say so explicitly: -p 0.0.0.0:8080:80.
• Rootless Podman ports are blocked by the firewall until you allow them: sudo ufw allow 8080/tcp.

Docker starts on demand (socket activation), so it isn’t running unless you use it.