One container goes public for the demo day

The project is locked the way production should be: default deny, permission groups for the team, forty containers behind one policy. Then the conference happens, and one demo app needs to be reachable from a venue whose IP nobody knows in advance.

Container-level permissions override project-level ones wherever they overlap: the documented use is exactly this, a public container in a private project. PUT an override on the demo container and it opens, while the other thirty-nine stay sealed. After the talk, DELETE the override and the project policy is back in force.

No tunnel spun up for the day. No firewall ticket. No temporary rule someone forgets, because removal is one call.

The exception is an override, not a hole in the perimeter.