It doesn't need to be running unless you have guest portal.

I recently moved my internal network to containers - forgot to move the controller and didn't even notice until weeks later.