I just noticed that the container doesn't actually export port 443. You can still forward it, of course, but that's needlessly confusing.