Docker
Every service in my homelab runs under Docker Compose on one host. The posts here are about the parts of Docker that surprised me in that setup.
Why Docker's published ports bypass your firewall
Why does a port published by Docker bypass my host firewall?