[callamdelaney]

Similar here, UFW setup to only enable access via Caddy to our http services - wait, why can I connect directly to our redis instance?

Took a while to workout that for some reason docker-compose is messing directly with iptables to shoot holes in the firewall we'd configured. Figured out you have to write your compose in some super special way to disable that functionality. Compose should never ever open network ports, ever in my book - to do so without a warning or anything though is like I said, insane!