> and without a firewall, people on the train will be attacking your containerized apps.

I was surprised when I learned this but Docker by default bypasses UFW and potentially other firewalls relying on iptables.

https://blog.viktorpetersson.com/2014/11/03/the-dangers-of-u...