Why might EXPOSE alone not be enough to access a container's service?

EXPOSE is purely documentation/metadata about which port the application listens on inside the container — it does not publish or map that port to the host. Actual host accessibility requires `-p`/`--publish` at `docker run` time (or a `ports:` mapping in Compose).