Ah yes, this footgun. Sometime last year I discovered our QA databases had all been locked with a ransom demand, how were they exposed? We had `ufw` blocking the db port?! Ah yes, Docker -p. smh.