It all just depends on how much you trust the app, and how you’ve set up things when it does go wrong. Not every container needs to be able to access other containers on the system, lan, have access to whatever folder, read/write permissions, etc
A good practice for things like vaultwarden would be to only whitelist the country/state you’re in to minimize your attack profile
fail2ban or crowdsec can also help with all the rats sniffing around
seems like a fire hazard no?