IMO this shouldn't be Docker-specific. There are any number of reasons that the public IP might not match the listen IP.