[cxcorp]

This is even worse than falsely binding to 127.0.0.1. If I don't publish a port in a container, I expect to *not publish any ports*.