Why might Kafka work fine from the host but fail for external clients connecting to a Dockerized broker?

The classic cause is `KAFKA_ADVERTISED_LISTENERS` (or its older alias) being misconfigured — Kafka tells clients which address to reconnect to after the initial connection, and if that advertised address is only resolvable/reachable from inside the Docker network (e.g., the container's internal hostname), external clients can connect initially but fail on the follow-up metadata-driven reconnect.