> When I containerized MongoDB, Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the world.

Yeah I had the same problem. If you are not using orchestration engines like Swarm of Kubernetes you can just avoid it by explicitly binding the port to your local interface (i.e. -p 127.0.0.1:27017:27017 instead of just -p 27017:27017)