Here’s an example from a guide a wrote. This was for an older version, so I don’t think it works as-is for the current one (namely due to change in default auth in redis).
As you can see, because redis was only receiving connections from another container in the same docker network, I had no port open for redis at all. It’s only needed if you’re taking connections from outside the docker network. I have no open port on MariaDB either.
The ports are still “open” per se, and you can see them in docker compose ps, but they aren’t port forwarded to the container from outside the docker network. That’s what the port spec on the container does.