n: = Using the DTR web UI to make all tags in the repository immutable is not a good way to prevent an image, such as 'nginx:latest', from being overwritten by another user with push access to the repository. This is because making all tags immutable would prevent any updates to the images in the repository, which may not be desirable for some use cases. For example, if a user wants to push a new version of 'nginx:latest' with a security patch, they would not be able to do so if the tag is immutable. A better way to prevent an image from being overwritten by another user is to use the DTR web UI to create a promotion policy that restricts who can push to a specific tag or repository1. Alternatively, the user can also use the DTR API to create a webhook that triggers a custom action when an image is pushed to a repository2. References:
* Prevent tags from being overwritten | Docker Docs
* Create webhooks | Docker Docs

Explanation
Using either EXPOSE or --publish to access the containers on the bridge network makes the container reachable from its host's network. The EXPOSE instruction in the Dockerfile specifies which ports the container listens on at runtime, while the --publish option maps a port on the host to a port in the container.
Both options allow external access to the container's services. References:
https://docs.docker.com/engine/reference/builder/#expose,
https://docs.docker.com/config/containers/container-networking/