There was a quite severe vulnerability in Docker IP Tables that was fixed recently in v28. Previously the docker engine would accept request to internal docker IPs for un-exposed ports when on the same LAN. It is being downplayed by the docker team, but think any time you might have been in an adversarial network with your laptop.