Why can't I connect to this docker container?

I’ve got a java servlet container running in edge_web_1 which I can access on port 8080 and I can’t access 80 or 443 on edge_nginx_1. Any ideas?

    # docker ps
    CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                                      NAMES
    99c26fe2117e        nginx:1             "nginx -g 'daemon ..."   27 minutes ago      Up 27 minutes       0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp   edge_nginx_1
    571ef4787dbc        edge_web            "/tmp/entrypoint.sh"     27 minutes ago      Up 27 minutes       0.0.0.0:8080->8080/tcp                     edge_web_1
    7f0c15522a70        mongo:3             "/entrypoint.sh mo..."   58 minutes ago      Up 27 minutes       27017/tcp                                  edge_db_1

From the docker host:

    # curl localhost:8080
    {"code":404,"message":"HTTP 404 Not Found"}

(The json response means I’m through to the servlet container, a 404 is fine for this).

    # curl localhost:80
    curl: (52) Empty reply from server

I get the same for 443. I’ve tried using 18080 instead of 80 in case it was something to do with privileged ports. The host is created using docker-machine with the digitalocean driver. The containers are configured with docker-compose and it all works both locally and with the virtualbox driver.

Curiously (to me) on virtualbox docker-machine set things up to run as the docker user, on digitalocean it seems to run as the root user. The iptables rules are very different too, but the digitalocean ones look no different for 80 than 8080.

    # iptables -L -n
    Chain INPUT (policy ACCEPT)
    target     prot opt source               destination
    
    Chain FORWARD (policy DROP)
    target     prot opt source               destination
    DOCKER-ISOLATION  all  --  0.0.0.0/0            0.0.0.0/0
    DOCKER     all  --  0.0.0.0/0            0.0.0.0/0
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
    
    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination
    
    Chain DOCKER (1 references)
    target     prot opt source               destination
    ACCEPT     tcp  --  0.0.0.0/0            172.17.0.4           tcp dpt:8080
    ACCEPT     tcp  --  0.0.0.0/0            172.17.0.3           tcp dpt:443
    ACCEPT     tcp  --  0.0.0.0/0            172.17.0.3           tcp dpt:80

Chain DOCKER-ISOLATION (1 references)
target     prot opt source               destination
RETURN     all  --  0.0.0.0/0            0.0.0.0/0