According to this page:
There is an 'address' parameter:
This attribute specifies the TCP/IP address on which this server
listens for the shutdown command. The default value is localhost,
which means that the server can be shut down from the same machine
where it is installed (i.e., remote shutdown is disabled).
Setting the address parameter to 0.0.0.0 will enable the container to listen on the hosts IP address.
<Server port="8005" address="0.0.0.0" shutdown="SHUTDOWN">
Map the shutdown port (in this case 8005) to a host port.
You can change the shutdown parameter to a random string, or use appropriate firewall/security groups to manage securing the port.