A working Docker setup can still expose more than necessary, and I learned that the hard way.