Data and networking
Publish ports deliberately
Distinguish a process listening inside a container from a host port published to local or external clients.
8 minute lesson
The Notes API listens on port 3000 inside its container. Clients on the host need a published port to reach it.
-p 127.0.0.1:8080:3000 maps host port 8080 to container port 3000 and limits host access to the loopback interface. Omitting the host IP usually publishes on all host interfaces.
docker run --name notes -d -p 127.0.0.1:8080:3000 notes-api:dev
docker port notes
curl http://localhost:8080EXPOSE in an image does not publish anything. Publishing is a runtime decision that creates a path from a host interface to a container port. The host and container port numbers do not need to match, and two containers can use the same internal port as long as their host mappings differ.
The host address controls exposure. Loopback is a safer development default; binding to all interfaces may make the service reachable from the local network or beyond, depending on firewall and routing rules. Databases used only by other containers usually need no published port at all. Confirm the actual mapping with docker port rather than inferring it from the Dockerfile.
Run the API with the loopback-only mapping, inspect it, then try a different host port without changing the image.
Lesson completed