If you run traefik and all your containers are accessible over https, and you are publishing emby/plex/jellyfin over 443, heres a tip to further harden your box. In portainer open each container except for traefik. Delete all published ports and deploy, then remove the bride network for each leaving only the plexguide network attached. Since traefik and the app containers talk to each other over the plexguide network, there is no need to publish any ports, even to the loopback address on the host. The exception hete is if you access containers over a port other than 443 or want them accessible via the loopback address on the host.