Docker's iptables=false option seems to have not the desired behavior

Question

Good morning at all. I am running Ubuntu 14.04 server and Docker 1.8.1 and UFW is my front-end to manage iptables.

I need to run an application into a container. I do need the following behavior:

• my app need to connect to another machine on port, to say, 8888/tcp.
• I do not want that docker manages my iptables, hence i have set DOCKER_OPTS="--iptables=false" in /etc/default/docker. That done, docker should now skip to set ANY iptables rule.

Then, i have done the following in UFW in order to get docker containers connect to the outside world:

• set DEFAULT_FORWARD_POLICY="ACCEPT" in /etc/default/ufw
• set net.ipv4.ip_forward=1 and net.ipv4.conf.all.forwarding=1 in /etc/sysctl.conf

I have also added the following lines to /etc/ufw/before.rules to enable NAT functionalities:

# nat Table rules
*nat
:POSTROUTING ACCEPT [0:0]

# Forward traffic from private network through eth0, the Internet iface on master.
-A POSTROUTING -s 172.17.42.1/16 -o eth0 -j MASQUERADE

# don't delete the 'COMMIT' line or these nat table rules won't be processed
COMMIT

where 172.17.42.1/16 is the docker iface ip range.

After a reboot, i have ran sudo iptables -t nat -L -n, which gives me:

[....]
Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  172.17.0.0/16        0.0.0.0/0 

Then, since my DEFAULT_OUTPUT_POLICY is set to DROP, and i wanted to test whether the iptables=false option actually works, i have ran:

docker run -it ubuntu:14.04 bash
root@56997560933c:/# apt-get update

but..the container is able to download updates, even if the port 80/tcp and 53 are not open to the outside on the host machine..

I am know wondering...what i did wrong? what more i have to do in order to avoid that a docker container connects to the outside world using a port that i have not allowed in my iptables (using UFW) ?

THANK YOU.

Note for completeness: There are no traces of DOCKER in any chain in my iptables. Also, when downloading updates, if i run netstat , there are no ESTABLISHED connections outside ssh...this is even stranger...

reported from this question of another user, posted on stackoverflow. I think this is the right place.