> Any port you map on the host will be opened in nftables ...

That rates a "Wow!" but seems like something more important to Enterprise/Cloud. It seems like it would be a Bad Thing to open a port because a DB server ran in a different container. That's not something that should be opened unless the DB is on a different host (VM) from an application that uses the DB.

In my case I have a firewall/router protecting my home LAN and don't generally run firewalls on individual hosts.