[goatinaboat]

When I containerized MongoDB, Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the world.

This is crazy. Your network should have been on a private IP address space behind a firewall running static NAT exposing only ports 80 and 443 on a routable IP address. This is network architecture 101.