[hermitmaster]

You’re correct. All the traffic should be routed to the nginx endpoint and the host should be vanilla.

[zepearl]

I don't agree (based on the fact that the host can run multiple images/VMs). In my opinion first of all the host should be secured (Firewall & Fail2ban etc...).

To distribute security to the single images/VMs increases complexity and the likeliness that some image/VM will miss some security filter, and leaves the host itself unprotected (e.g. network time sync & ssh & other stuff will probably be running, any update to the host's SW might result in unexpected services running, etc...).

An additional (dedicated) layer of security in the images/VMs would of course still be ok.

[kenniskrag]

But you can also use a container as first contact and redirect to other containers. You can bind a network device to a container.

For example a reverse proxy container which redirects to a gitea container or a wordpress container depending on the request. The reverse proxy container can also centralize the security with certificate handling or fail2ban.