Avoid binding on public ip ports

I was thinking it would maybe be safer to avoid binding the docker images on public ports. Instead let nginx proxy to the private docker ip addresses. This way you avoid people portscanning your host and directly connecting to a running docker image, bypassing any security you might have put up in the nginx configuration.