I prefer to run the webserver using systemd on the host so publishing the container port to 127.0.0.1 is enough for me.