Until they learn that Docker adds iptable rules on their own and open every port automatically.

I've been bitten by this, was a pain in the ass to figure out that something was messing with the iptables rules.

Every port on the machine, or every port on the container?

The container's ports that you explicitly expose.

E.g. `docker run -p 8080:80 nginx` will expose the container's port 80 as port 8080 on the host. That port will be open whether or not the host has a firewall configured to block 8080.

You can do `docker run -p 127.0.0.1:8080:80 nginx` to only have the port on the host accessible on the loopback interface (for example if you have a reverse proxy on the host, proxying to 127.0.0.1:8080).

There's also the option to spin up a tiny VM with pfSense/OPNsense and have it act as a bastion, is there not? Or would it introduce too much latency?

From my experience their cloud offerings are much slower network wise than the dedicated ones.

Not quite. It's easier to define one set of rules for the entire server group (Projects in Hetzner terminology) and forget about it than to manage OS firewalls individually.