only expose port 5000 to local system