Comment by sneak

The mistake here is a MongoDB that didn't require authentication, not that docker's clunky iptables setup exposed it to the internet.

Relying solely on a host-based firewall for access control is, for reasons which must now be obvious, admin incompetence.

They are responsible for securing the containers. They didn't.

Your services should be using authentication even if they are only bound to localhost.