Docker punches holes in it: >By default, all external source IPs are allowed to connect to the Docker host. To allow only a specific IP or network to access th

Docker punches holes in it: >By default, all external source IPs are allowed to connect to the Docker host. To allow only a specific IP or network to access the containers, insert a negated rule at the top of the DOCKER-USER filter chain. Yikes. Should people read the docs? Yes. Should Docker not do this? Also yes.