[elashri]

I do make the habit of not expose ports and just use reverse proxy for the container. Of course, you will need a bridged network between the reverse proxy container and the target container, but that's fine. I'm sure there is more clever ways around that.

[ggpsv]

I prefer to run the webserver using systemd on the host so publishing the container port to 127.0.0.1 is enough for me.