Please say more.

I use both on a daily basis and from what I understand, there’s no implicit access from within a container. If you set it up right, there’s no access outside the container of any sort unless you explicitly say so.