The ports listening on public addresses, from /proc/net/tcp and /proc/net/tcp6, and the ports Docker publishes.
Does it need root?
It reads everything it needs as a normal user.
When it passes
The report lists it as passed, in these words:
Only allowed ports are open (ports)
What it can find
Warning
Port port is open on a public address
Every open port is a way in. Only ports you mean to serve should be open. If this one should be open, add it to ports.allowed in /etc/kiyesi/config.yaml.
Fix
Bind the program to 127.0.0.1, or close the port: sudo ufw deny port