1. `docker run -p 0.0.0.0:6666:6666 ...` - docker will update the firewall to allow traffic to port 6666
2. `docker run -p 127.0.0.1:6666:6666 ...` - docker won't update the firewall.
3. `docker run -p 6666` - the port is published on 0.0.0.0 and a random port is opened on the host
I see 3 being a little surprising, but 1 and 2 does what I would expect of it.
I don't think Docker should touch the firewall whatsoever. Apache doesn't, nginx doesn't, PostgreSQL doesn't, etc. Why is Docker different? The sysadmin should decide that!
`docker run -p 6666:6666 ...` which defaults to `-p 0.0.0.0:6666:6666`
I can't find it in the article, but I suspect this what actually happened. It's a bad default and unfortunately most examples build on it.
Similar, it's easy to deploy MongoDB without a password. But it's also easy to set one, the docs even mention it https://hub.docker.com/_/mongo
And everyone can run a portscan with nmap against their servers. Unfortunately the MongoDB default ports 27017-27019 are not part of the top 1000 ports which nmap scans by default.