It starts with the simple truth: `docker` doesn't `listen` on any port.
Or maybe a simple question: How can I run `docker run -p 8080 nginx` over and over without port conflict?
Or - lets expand scope even more. How is docker supposed to know about your choice of firewall? What about upstream firewalls? What about multiple versions of firewalls on a host (ufw vs. fern vs.)?
Can go on and on..