fail2ban | ban hosts that cause multiple authentication errors | Firewall library

You are looking at buffering. It will print something eventually, but only when you have enough output for the buffer to be flushed. This is a common FAQ.

Anyway, you can easily refactor this to a single Awk script, which avoids the problem.

This has nothing to do with docker or wordpress or something else.
It is your nginx-configuration solely that rejecting the request:

You have Curl in your http-agent comparison in nginx-server.conf:

Answer instead of edit, since it is significant: A fix for the service crash is as follows.

What you did would prevent your hosting provider to connect via ssh, but as long as they have physical access to the machine they host, you could imagine they could unplug the machine at any time and just look into the hard drive directly by plugging it into another machine. If the machine is a virtual machine or have some way to have its hardware remotely controlled. They might not even have to shutdown it, and they could possibly directly see what lies in the memory as well...

Of course if it is a serious business they won't do that, but the point is, if you cannot see (literraly with your eyes) what is happening with the hardware then you have to trust.

Apart from the provider, increasing network security is always a good idea, one advice from my own provider was to add an ip whitelist to the ssh port firewall rule (of course you need to ensure you will hold access to the ip you put in the whitelist if you put the whitelist directly on the machine, otherwise you may lose access to your own machine. Lots of cloud provider provides a "security groups" feature in their administration console, if that is your case, you could use that)

If /var/log/access.log is a symlink to stdout, it's not going to be available in the other container: /dev/stdout points to the stdout of the current process, so when fail2ban attempts to read from it, it gets its own stdout, rather than the stdout of the nginx process.

If you want fail2ban to be able to read the logs from nginx, you will need to write them to an actual file. If you also want them showing up on the container stdout, you can run something like a tail -f in the background of the nginx container.

OFFTOPIC: please move this question to serverfault or other better suitable site for that (this is offtopic for SO)

as for your issue, just stop to use catch-alls (.* etc), e. g. one correction to make it work could be:

The second message (did not issue MAIL/EXPN/VRFY/ETRN) can be found if you would set mode aggressive by sendmail-reject jail (after this fix, e. g. v.0.10.6 and 0.11.2).

There was indeed no exact rule for the first message (rate limit exceeded) matching this kind of message exactly, due to different handling on the arguments, but...
I fixed this now in f0214b3 on github.

Unless not released you can extend it by yourselves either in filter (copy & paste from github filter) or directly in jail:

You can not do that using iptables (especially if the packets are encrypted due to https traffic).

But if you use fail2ban and nginx, you can try the action nginx-block-map. Just use variable $http_x_forwarded_for in the map (see action description) and provide it in log, fail2ban will monitor, so the filter would be able to capture it as an ID to ban.

From the manual page:

If a source value matches one of the names of special parameters described below, it should be prefixed with the “\” symbol.

So it's unnecessary (but harmless) for values such as 127.0.0.1, but it defends against using hostnames such as default, hostnames, volatile or include, which are considered "special parameters" within the map block.