AWS Lightsail Docker Firewall Setup

Docker containers bypass UFW by default on AWS Lightsail servers. The fix: bind container ports to 127.0.0.1 and use DOCKER-USER chain rules.