Yeah I don't want to pretend that it's not a footgun, because it is a footgun and it should have defaulted to binding to 127.0.0.1... but it does not "insert an

Yeah I don't want to pretend that it's not a footgun, because it is a footgun and it should have defaulted to binding to 127.0.0.1... but it does not "insert an allow rule" or "override the firewall" or anything like that. It just uses forwarding rather than listening on a port, because container and virtual machines are not regular processes, and the iptables "nat" table is used before the "filter" table that his firewall uses. So I agree with you, the author is being very dishonest here.