Why would a DB on port 3306 be inaccessible from the Internet, but a containerized one is accessible

Summary:

A MySQL database running directly on an instance is not accessible from the Internet at large, but a dockerized MySQL database on the same port on the same instance is accessible. Both are using the same my.cnf file.

Content (please ensure you mask any confidential information):

A MySQL database running directly on an instance is not accessible from the Internet at large, but a dockerized MySQL database on the same port on the same instance is accessible. Both are using the same my.cnf file.

I have the following from netstat: tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN

…and the following from iptables: