It's by design from the OS.  It assumes that any ports etc that aren't defined in your template are new to the update and adds them in.   Is it a particular issue for you, or just an annoyance.   If it's an issue for the container itself adding them back in, then you can post in the applicable support thread for the app to have them modify the template accordingly to avoid this behaviour (there is a way for them to not have this happen)   If it's an annoyance / prob