Explicitly specify loopback IP when exposing container ports

[ok300]

The common way ports are exposed in docker -p 5432:5432 is actually equivalent to -p 0.0.0.0:5432:5432, which binds the port to all of the host's IPs.

Since docker bypasses local firewalls like ufw and iptables (docker/for-linux#690) , a user that would follow our docs to setup a Postgres container on a VPS VM will inadvertently expose the Postgres port and container to the internet.

To follow security best practices, this PR switches to a port notation that explicitly binds it to the host's loopback IP.