SSH tunnel to bridge external apps into Docker’s internal network no exposed DB ports, just SSH.