It doesnt actually bypass the firewall.

When you tell docker to expose a port on 0.0.0.0 its just doing what you ask of it.

If you don’t want ports exposed outside the machine then don’t add the config to do so!