Docker docs:
Docker routes container traffic in the nat table, which means that packets are diverted before it reaches the INPUT and OUTPUT chains that ufw uses. Packets are routed before the firewall rules can be applied, effectively ignoring your firewall configuration.
I think it’s less about making it portable to different OS, and more different versions of the same os on different machines with different configuration and libraries and software versions.