Publishing Ports

In this lesson, we’ll explore how Docker publishes container ports to the host system. We begin with basic port mapping, then move on to advanced options like interface binding, dynamic port allocation, and automatic exposure. By the end, you’ll understand how Docker leverages iptables to route traffic between host and container.

1. Container vs Host IP

A containerized web application typically listens on an internal port (e.g., 5000). Every container receives an internal IP (for example, 172.17.0.2), which is only reachable from the Docker host:

curl http://172.17.0.2:5000

However, this IP isn’t accessible from other machines. To allow external access, you must map the container port to a port on the host (e.g., 192.168.1.5).

2. Publishing a Fixed Port (-p)

To map container port 5000 to host port 80, run:

docker run -p 80:5000 kodekloud/simple-webapp

Now your application is accessible at:

http://192.168.1.5:80

Multiple Instances on Different Ports

You can launch multiple containers binding the same internal port to different host ports:

docker run -d -p 8000:5000 kodekloud/simple-webapp
docker run -d -p 8001:5000 kodekloud/simple-webapp

For database services:

docker run -d -p 3306:3306 mysql
docker run -d -p 8306:3306 mysql
# The next command fails if port 8306 is in use:
docker run -d -p 8306:3306 mysql

3. Binding to Specific Host Interfaces

If your machine has multiple network interfaces, you can restrict port binding to a particular IP:

# Bind only on 192.168.1.5
docker run -p 192.168.1.5:8000:5000 kodekloud/simple-webapp

# Bind only on loopback (accessible locally)
docker run -p 127.0.0.1:8000:5000 kodekloud/simple-webapp

4. Dynamic Host Port Allocation

Omitting the host port lets Docker assign a random port (default range 32768–60999):

docker run -d -p 5000 kodekloud/simple-webapp

To view the port range:

cat /proc/sys/net/ipv4/ip_local_port_range
# Example output:
# 32768 60999

5. Publishing All Exposed Ports (-P)

If an image’s Dockerfile declares one or more EXPOSE ports, you can automatically map them to random host ports:

# Dockerfile snippet
FROM ubuntu:16.04
RUN apt-get update && apt-get install -y python3 python3-pip
RUN pip3 install flask
COPY app.py /opt/
ENTRYPOINT ["flask", "run", "--host=0.0.0.0"]
EXPOSE 5000

Build and run:

docker build -t simple-webapp .
docker run -P simple-webapp

You can also expose additional ports at runtime:

docker run -P --expose=8080 simple-webapp

Inspect the exposed ports:

docker inspect simple-webapp --format '{{json .NetworkSettings.Ports}}'
# Example output:
# {"5000/tcp":[{"HostIp":"0.0.0.0","HostPort":"32768"}],
#  "8080/tcp":[{"HostIp":"0.0.0.0","HostPort":"32769"}]}

6. Port Publishing Options at a Glance

7. Under the Hood: iptables NAT

Docker uses Linux iptables to forward traffic from host ports to container IPs. It creates custom chains (DOCKER, DOCKER-USER) in the nat table:

1. Packet arrives on the host port.
2. PREROUTING chain directs it to the DOCKER chain.
3. A DNAT rule rewrites the packet’s destination to the container’s IP and port.
4. The packet is forwarded to the container.
5. Response packets are SNAT’d or MASQUERADE’d back to the host.

Inspect Docker’s NAT rules:

iptables -t nat -S DOCKER
# Sample output:
# -N DOCKER
# -A DOCKER ! -i docker0 -p tcp -m tcp --dport 41232 \
#     -j DNAT --to-destination 172.17.0.3:5000

Further Reading and References

• Docker Networking Overview
• Docker Run Reference
• iptables Manual