Have you changed the sysctl net.ipv6.bindv6only from it’s default? Because if not, that IPv6 listening socket is also accepting IPv4 connections. Your problem, then, lies elsewhere – likely in firewall settings. Note, also, that by default docker will use iptables to redirect incoming connections, and those docker-proxy processes will not actually receive any connections, so it’s the listening sockets inside the container that will be receiving the connections.