You should try podman instead. The rootless version obviously can’t bypass UFW. When I tested podman as root it also didn’t punch holes into UFW. Not sure how it is today however.