> Poking a hole directly to the container is a leaky abstraction. A reverse proxy like HAProxy or Varnish should be sitting in front of the container.

It might be a stupid question but I wonder what's considered a leaky abstraction in this case.

By the way, I'm not sure I fully understand your concerns over reverse proxy routing, but I recall that Ambassador pattern linking[0] is a suggested way of tying Docker containers over network. Also, these slides by dotCloud[1] may be helpful as well (I'm not sure if approaches described are up-to-date, though).

[0] http://docs.docker.io/en/latest/use/ambassador_pattern_linki...

[1] http://www.slideshare.net/dotCloud/deploying-containers-and-...