Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesEXPOSE documents the port an application is expected to listen on inside a Docker container; it does not publish that port on the host. To make a container port reachable through a host port, use docker run -p HOST_PORT:CONTAINER_PORT IMAGE. For example, -p 8080:80 maps host port 8080 to container port 80.
What Docker’s EXPOSE instruction does
In a Dockerfile, EXPOSE records a port and protocol as image metadata: it tells image users which container port the application is expected to use. Docker describes it as documentation between the image builder and runner. It does not create a host mapping, add a firewall rule, or make the application listen. The application itself must bind to the port inside the container. Dockerfile reference
EXPOSE 80TCP is the default protocol, so EXPOSE 80 means TCP port 80. To document UDP, write EXPOSE 80/udp. If an application uses both TCP and UDP on port 80, declare both separately:
EXPOSE 80/tcp
EXPOSE 80/udpThese declarations describe the container port; publication is a separate runtime choice.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
EXPOSE vs. –expose vs. -p vs. -P
| Option | What it does | Publishes to the host? |
|---|---|---|
EXPOSE 80 in a Dockerfile |
Records the intended container port and protocol in image metadata. | No. |
--expose 80 on docker run |
Adds exposed-port metadata for that container at runtime. | No. It can mark a port for publication by -P. |
-p 8080:80 on docker run |
Maps a specified host port to a specified container port. | Yes. |
-P on docker run |
Publishes declared exposed ports using randomly selected host ports. | Yes. |
The Docker CLI reference documents the runtime --expose, -p, and -P options. Docker run reference
Publish a container port with -p
Use -p (or its long form, --publish) when you want a known host port. The order is HOST_PORT:CONTAINER_PORT:
docker run -p 8080:80 nginxHere, connections arriving at host port 8080 are forwarded to port 80 in the container. The host and container port numbers do not have to match. Docker’s publishing guide describes this as mapping a host port to a container port. Port publishing and mapping
Rank #2
TCP is the default. To publish UDP port 80 in the container through UDP host port 8080, specify the protocol:
docker run -p 8080:80/udp nginxTo publish both protocols on those port numbers, make both mappings explicit:
docker run -p 8080:80/tcp -p 8080:80/udp nginxThe Docker run reference also accepts SCTP as a protocol option. Select the protocol your application actually uses; a TCP mapping does not publish its UDP traffic. Docker run reference
Rank #3
Choose who can reach a published port
If you omit the host IP, Docker publishes the mapped port on all host addresses by default. That can make the service reachable beyond the host, depending on routing, firewall rules, and other network controls. Docker warns that publishing container ports is insecure by default; this is a warning about the broad default bind, not a claim that every published service is necessarily reachable from the public internet. Docker port-publishing security guidance
For a service intended only for software running on the Docker host, bind the host side to loopback:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
docker run -p 127.0.0.1:8080:80 nginxThis documented configuration restricts access to the host’s loopback address. Docker notes a specific historical exception: on hosts running Docker releases older than 28.0.0, other machines on the same layer-2 network could reach ports published to localhost. Keep that caveat scoped to those older releases. Docker port-publishing guidance
Docker manages networking rules itself, so do not assume a host firewall tool’s default policy necessarily blocks a published port. Actual exposure also depends on the Docker version, network mode, daemon settings, IP version, routing, and firewall configuration. Check the port-publishing guide when diagnosing a setup that differs from the standard bridge-network case. Docker networking guide
Use -P for automatic host-port selection
-P publishes ports declared with EXPOSE (or runtime --expose) to randomly selected host ports. It is useful when you do not need a fixed host port, such as when running several instances that would otherwise compete for the same one.
docker run -P nginx
docker port CONTAINERUse docker port CONTAINER to see the mappings Docker selected. The run reference says these random host ports are chosen within the ephemeral port range defined by /proc/sys/net/ipv4/ip_local_port_range. Unlike -P, -p lets you choose the host port yourself. Docker run reference
Best Value
- Docker, Docker Swarm, Docker Compose, Programmer, Developer, Coding, Programming, Software Engineer, Code, DevOps, Deploy, Deployment, Kubernetes, Salt, Puppet, Chef, Terraform, Container, AWS, Azure, Cloud, Geek, Funny, Computer, Software, Tech, IT
- Integration, Scrum, Compile, Compilation, Science, Bug, Debug, Python, Linux, Java, Javascript, Scala, Dotnet, Kotlin
- Lightweight, Classic fit, Double-needle sleeve and bottom hem
Container-to-container access does not require -p
Publishing is for access through the Docker host; it is not a prerequisite for communication between containers on a shared Docker network. On a bridge network, containers connected to that network can reach one another using their container ports, while the Docker host can also access those ports. A container on another network, or a machine outside the host, does not ordinarily gain access merely because the application listens inside the container. Use a host publication or a separately configured route when host or external access is needed. Docker port-publishing guide
Keep the distinction clear: a process may be listening on a container port; another container on its network may be able to reach it; and a host port may or may not be published. Those are separate conditions.
Docker Desktop adds a forwarding layer
On Docker Desktop, published traffic passes through the Desktop backend, which listens on the selected host port and forwards the connection into the Linux VM before it reaches the container. The backend process is named com.docker.backend on Mac and com.docker.backend.exe on Windows; the networking guide identifies qemu for Linux. This Desktop-specific path can matter when troubleshooting firewall, VPN, or endpoint-security behavior. Docker Desktop networking
Quick troubleshooting checks
- The host cannot connect: confirm the application is listening on the container port, then check whether you used
-por-P.EXPOSEalone does not publish a port. - The connection uses the wrong port: read
-pas host first, container second; inspect automatic mappings withdocker port CONTAINER. - A service should be local-only: bind the host side to
127.0.0.1rather than omitting the host address. - Another container needs access: connect both containers to the same Docker network and use the application’s container port; host publication is not needed for that path.
- Desktop networking behaves differently: account for the backend-to-VM forwarding layer and any host VPN or security software.
For unusual routing, bridge gateway modes, direct routing, firewall behavior, or Swarm services, consult Docker’s networking documentation for the relevant configuration. Swarm service publishing has separate ingress and host modes; it is not interchangeable with the single-container docker run -p example. Docker port-publishing guide
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
