Will the container be limited to listening on the `exposed` ports? or does it get to do anything it likes?