I think exposing 8080:8080 would result in sockets bound to 0.0.0.0:8080 in eith...

I think exposing 8080:8080 would result in sockets bound to 0.0.0.0:8080 in either Docker or Podman. You still need 127.0.0.1:8080:8080 for the socket binding to be 127.0.0.1:8080 in Podman. The only difference is that Podman would not punch holes in the firewall after binding on 0.0.0.0:8080, thus preventing an unintended exposure given that the firewall is set up to block all incoming connections except on 443, for example.

Edit: just confirmed this to be sure.

    $ podman run --rm -p 8000:80 docker.io/library/nginx:mainline
    $ podman ps 
    CONTAINER ID  IMAGE                             COMMAND               CREATED         STATUS         PORTS                 NAMES
    595f71b33900  docker.io/library/nginx:mainline  nginx -g daemon o...  40 seconds ago  Up 41 seconds  0.0.0.0:8000->80/tcp  youthful_bouman
    $ ss -tulpn | rg 8000

    tcp   LISTEN 0      4096                                          *:8000             *:*    users:(("rootlessport",pid=727942,fd=10))