Works with `curl localhost`, refused from every other machine

• A Node.js service in a container answers curl http://localhost:3000 inside the container.
• From the host and from other containers, curl http://<container-ip>:3000 fails instantly with "Connection refused".
• The container’s port mapping -p 3000:3000 is in place.
• No firewall rules exist on the host.

# inside the container
$ ss -tlnp
State  Recv-Q Send-Q Local Address:Port  Peer Address:Port  Process
LISTEN 0      511        127.0.0.1:3000       0.0.0.0:*     users:(("node",pid=1,fd=18))

# from the host
$ curl -v http://172.17.0.2:3000/
*   Trying 172.17.0.2:3000...
* connect to 172.17.0.2 port 3000 failed: Connection refused

$ tcpdump -ni docker0 port 3000
16:41:02.011 IP 172.17.0.1.40112 > 172.17.0.2.3000: Flags [S], seq 88213
16:41:02.011 IP 172.17.0.2.3000 > 172.17.0.1.40112: Flags [R.], seq 0, ack 88214