In an enterprise setting, you shouldn’t trust the server firewall. You lock that down with your network equipment.
Edit: sorry, I failed to read the whole post 🤦♂️. I don’t have a good answer for you. When I used docker in my homelab, I exposed services using labels and a traefik container similar to this: https://docs.docker.com/guides/traefik/#using-traefik-with-docker
That doesn’t protect you from accidentally exposing ports, but it helps make it more obvious when it happens.






Which logs did you look at already?
If you’re using journalctl, I think you should have shutdown messages in the log. You might need to filter by the previous boot for them though (https://linuxhandbook.com/journalctl-boot-logs/).
For dmesg, you might have old, rotated logs from previous boots in your /var/logs folder.
I’d expect any logs around power management to end up in one or both of those places.
You could also try manually triggering a suspend or hibernate to see what happens. I remember having a machine that would suspend fine, but if it was suspended too long, it would hibernate. And for some reason it didn’t know how to come back up after a hibernate.