You do have to remember that all your containers are running with your host kernel, with your hosts isolation stack (SELinux vs AppArmor), your hosts firewall stack (ufw/firewalld/iptables/nftables) and the container engine ends up integrating with the host in lots of odd ways.