No, the Postgresql container is exposed only on the VPN interface (Zerotier).

The only exposed containers are (usually) Traefik (80, 443). There is a docker network where traefik talks to all containers handling HTTP traffic.

Other containers run in their own separate docker networks.