Self-review: improvements from a second pass

• I added an explicit IPv6 note (after6.rules) so users do not harden only IPv4 by mistake.
• I kept the policy as an allowlist pattern in DOCKER-USER (trusted ranges + 80/443 + drop) because it is easier to audit than many per-port block rules.
• I also added a short link from Docker install docs to this security section, so users can find it early.

Greptile Summary

Added comprehensive Docker + UFW firewall hardening guidance to address a common security gap where users assume UFW alone protects Docker-published ports. The new documentation explains that Docker's forwarding chains bypass typical INPUT rules and provides a concrete DOCKER-USER iptables allowlist configuration with:

• Clear explanation of why UFW alone is insufficient for Docker port publishing
• Minimal working example of DOCKER-USER chain rules for IPv4
• IPv6 consideration pointing to after6.rules
• Validation commands using ufw, iptables, ip6tables, and nmap
• Cross-reference added to Docker installation docs so VPS users discover this guidance early

The documentation follows repository conventions with proper Mintlify-compatible formatting, root-relative links, and generic placeholders. The iptables rules are technically sound as a minimal example and provide actionable hardening for self-hosted VPS deployments.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk as it only adds documentation with no code changes.
• Documentation-only change that addresses a real security concern with accurate technical guidance. The iptables rules are valid, the formatting follows repository conventions (root-relative links, proper backtick usage, generic placeholders), and real-world testing was performed per the PR description. No code execution paths are modified.
• No files require special attention.

_{Last reviewed commit: b9b8066}

Security review note:

The Docker DOCKER-USER guidance is directionally solid and fills an important gap for VPS deployments.

Evidence I checked:

• Docs-only changes in docs/gateway/security/index.md and docs/install/docker.md.
• Current failing checks are not docs-specific:
  • protocol check drift (GatewayModels.swift diff)
  • shared Windows shard failures (src/plugins/loader.test.ts assertion)

Actionable suggestion:

1. Rebase and rerun so CI reflects this docs-only change cleanly.
2. Consider adding one sentence clarifying nftables environments (iptables-nft) so operators know the commands shown are expected to map to nft backends.

@bmendonca3 thanks, i applied both suggestions.

• synced this branch with latest main and pushed (c0cdaf0)
• added one sentence about iptables-nft frontend mapping in docs/gateway/security/index.md

local docs check is green (pnpm check:docs). if CI still shows red, it looks unrelated to this docs change.

Merged via squash.

• Prepared head SHA: 31ddd43
• Merge commit: 2cd3be8

Thanks @dorukardahan!

Thanks @grp06 for picking this up and merging it. I appreciate the changelog addition and the branch cleanup. I tested this guidance on my VPS and it matched what i observed in production.