When running this with docker it looks like the legend url is returned using the private endpoint, so the browser is unable to resolve it:
<img src="http://thredds:8080/thredds/wms/testAll/crossSeamProjection.nc?REQUEST=GetLegendGraphic&PALETTE=default&LAYERS=Temperature_surface&STYLES=default-scalar/default">
When running this with docker it looks like the legend url is returned using the private endpoint, so the browser is unable to resolve it: