- docker-compose.yml: server-core uses host network (no bridge isolation)
- docker-compose.yml: postgres/redis expose ports on 127.0.0.1 only
- docker-compose.dev.yml: also uses host network
- WireGuard now runs on host network stack (wg show works on host)
- nftables rules apply directly to host (proper peer isolation)
datadunia