I ran the Docker image, I'm not sure which docs I followed, it was a while ago, but in this case listening on localhost doesn't really apply.

Docker, as we know will open exposed container ports to the world, that shouldn't really be the baseline though for not having your instance compromised in less time than it takes to enter an iptables rule correctly, or read the guidelines.

I'm not trying to place blame, it was an exploratory endeavour anyway, but Meow existed because security in Mongo is a guideline and not a rule

As someone who builds secure software solutions for a living it doesn't thrill me that security is often an "optional extra" (looking at you elastic).

If I asked our customers/users the same question you just asked me, and then followed it up with "You must have compromised...", I'd be in hot water.

A combination of factors contributed to us choosing not to use Mongo at the time, if we have such a need again, it will be considered without prejudice.