Minimizing published Docker ports

[yamplum]

Hi. I'm trying to get a self-hosted SigNoz running on my server via plain Docker Compose. Checking the compose file, I noticed that it publishes a number of ports by default. Unfortunately, it is a known and longstanding issue in Docker that publishing container ports punches holes in the firewall, exposing them to the public. I'd like to lock down the access as much as possible. With that in mind, how should I adjust the default configuration? What services need to be exposed publicly and what can be left isolated on the bridge network/host machine? Thanks in advance.

[Ruppsn]

Why dont you work with iptables DOCKER-USER Chain?
https://docs.docker.com/engine/network/packet-filtering-firewalls/