security patch: bind port 5432 to docker0 interface, avoid exposing db server to outside world