Just about everyone who describes Docker, including the Docker documentation itself, describes "exposing" a port as creating a "mapping" between ports in the co

Just about everyone who describes Docker, including the Docker documentation itself, describes "exposing" a port as creating a "mapping" between ports in the container and ports on the host. Furthermore, the "container networking" page (https://docs.docker.com/config/containers/container-networking/ https://docs.docker.com/config/containers/container-networki...) says that Docker creates iptables rules for the purpose of creating this mapping. The clear implication is that, say, "exposing" port 8080 should have similar behavior to simply running a program on the host that listens on port 8080. It does do that, but it also silently punches holes in your firewall, unless you make Docker-specific changes to your firewall config to work around it. Even if a knowledgeable person reads the docs, and then sees something like "click here for the platform-specific details of how iptables rules are managed", I think it's entirely reasonable for them not to realize that those platform-specific details are in fact security-critical.