“When I containerized MongoDB, Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the world.”
The firewall said it was active. Docker quietly wrote its own rule underneath it and exposed the database to the internet. An automated bot deleted everything and left a ransom note. NewsBlur survived because the old primary was shut down but not yet deleted, which is luck, not a backup plan.