> you can prevent container from being publicly reachable by just not binding them to any public ports

well, that's what I opened with: https://news.ycombinator.com/item?id=42601673

problem is, I was told in https://news.ycombinator.com/item?id=42604472 that this protection is easier to work around than I imagined...