Interesting trick, it was definitely an "Oh shit" moment when I learned the hard way that ports were being exposed. I think setting an internal docker network also fixes this, though it complicates talking to other machines in the same firewall.