>Imagine having to adjust your documentation to go from [...] I sympathize with your reluctance to push a burden onto the users, but I disagree with this examp

>Imagine having to adjust your documentation to go from [...] I sympathize with your reluctance to push a burden onto the users, but I disagree with this example. That's a false dichotomy: whatever system-specific commands Docker executes by default to allow traffic from all interfaces to the desired port could have been made contingent on a new command parameter (say, --open-firewall). Removing those rules could have also been managed by the Docker daemon on container removal.