Docker: understand host and container port mappings
Distinguish container listeners, EXPOSE and published ports, with a loopback-bound example and a practical inspection sequence.
For Docker Engine bridge networking. Host networking and orchestration platforms have different rules. The example creates a container; first check that port 8080 is not needed by another service.
1. Read the mapping
127.0.0.1 is the host bind address, 8080 is the host port and 80 is the container destination. Open http://127.0.0.1:8080/ locally. Image tags can change; use your own version-pinning policy for production.
docker run --rm --name portcyou-demo -p 127.0.0.1:8080:80 nginx:stable-alpine2. Inspect publishing and the application separately
In another terminal, inspect the mapping, status and logs. EXPOSE is metadata, not a published host port. Publishing also does not create an application listener; a container-loopback-only listener may not be reachable through the mapping.
docker port portcyou-demo
docker ps --filter name=portcyou-demo
docker logs --tail 30 portcyou-demo3. Verify exposure and stop the example
Omitting the host address generally broadens exposure. Docker documents a localhost-publishing caveat on versions older than 28.0.0 for peers on the same L2 network; keep software current and verify network controls. Stop the disposable example afterward: --rm removes it on exit, so do not store valuable data inside.
docker stop portcyou-demoSources and review
Sources checked on: