A local Docker port is not local just because we call it that

Situation

Docker Compose's short `ports` syntax is convenient, but it does not inherently mean 'localhost only'. For development data, debug endpoints or an unfinished multiplayer service, publishing to broader interfaces creates unnecessary attack surface. I therefore did not consider The Last Spike's local workflow secure merely because we called it a development environment.

Approach

I bound published development ports explicitly to the loopback address and separated services that genuinely needed to be reachable from the host. Production topology remained a different concern behind a reverse proxy and TLS. The restriction was enforced in Compose configuration rather than left as a warning in documentation.

Outcome

The development environment remained just as convenient to use but no longer exposed internal ports accidentally to the local network. As later services were added, the rule also became explicit: a port reaches the host only when there is a deliberate reason for it.