Drive-by: make sure docker container does not expose ports on `0.0.0.0` and instead registers to localhost. This way websocket and vnc ports are not exposed to the public internet.