On this page: Docker - OpenSearch documentation
I think it might be better to warn people to bind the docker container to localhost. It may be a surprise to some new to docker that this instance is available to the web by default.
Suggested change from:
docker run -p 9200:9200 -p 9600:9600 -e "discovery.type=single-node" opensearchproject/opensearch:2.0.0
docker run -p 127.0.0.1:9200:9200 -p 127.0.0.1:9600:9600 -e "discovery.type=single-node" opensearchproject/opensearch:2.0.0