Only bind Docker container ports to the loopback address, rather than exposing these ports on every interface.