Docker makes a service inside a container reachable from your machine by publishing a container port on a host address and port. For example, docker run --rm -p 127.0.0.1:8080:80 nginx maps host port 8080 on loopback to port 80 in the container; open http://localhost:8080 to connect. The host and container port numbers can differ.
Be deliberate about the host address: -p 8080:80 binds on all host addresses by default, while -p 127.0.0.1:8080:80 limits ordinary access to the Docker host. Docker warns that “Publishing container ports is insecure by default.” Docker Engine documentation
As an Amazon Associate I earn from qualifying purchases.
What the host-to-container mapping means
A container has its own network isolation. An application can listen on a port inside the container without making that port directly available to programs on the host. At container startup, Docker’s -p (or --publish) option sets up forwarding from a host endpoint to the container’s address and port. On Docker Engine bridge networks, published ports use host firewall rules and network address/port translation (NAT/PAT and masquerading). Docker Engine documentation
Recommended Free Tools
The common syntax is HOST_PORT:CONTAINER_PORT. The host port is where a browser or other host-side client connects; the container port is where the service must listen. Docker Desktop uses a different implementation path: its backend listens on the requested host port, forwards traffic into the Linux VM where containers run, and routes it to the container. That implementation description applies to Docker Desktop, not every Docker Engine platform. Docker Desktop networking Docker Desktop networking how-tos
#1 Best Overall
Choose the host address and port deliberately
In docker run -p HOST_IP:HOST_PORT:CONTAINER_PORT, the optional host IP controls which host interface accepts connections. If it is omitted, Docker publishes to all host addresses by default. For local development, bind to loopback unless other machines need access.
| Command form | What it does | Typical use |
|---|---|---|
-p 8080:80 |
Maps host port 8080 to container port 80 on all host addresses by default. | Use only when access beyond the host is intended and the host network and firewall permit it. |
-p 127.0.0.1:8080:80 |
Maps host loopback port 8080 to container port 80. | Local-only development access from the Docker host. |
-p 192.168.1.100:8080:80 |
Binds host port 8080 on the specified host address to container port 80. | When the service should be available through that host interface. |
-p [::1]:8080:80 |
Uses IPv6 loopback for the host-side binding. | Local access over IPv6 loopback. |
The specific address in the third example must be assigned to the Docker host. A mapping to all addresses can expose a service beyond the machine, subject to network reachability and firewall rules; Docker notes that its firewall rules may apply even when UFW is configured. Docker Engine also documents a version caveat: before Docker Engine 28.0.0, hosts on the same L2 segment could reach ports published to localhost. Check the installed Engine version and network exposure when relying on loopback binding. Docker Engine documentation
Run a container with a published port
-
Choose the port where the application listens inside the container. In the example below, that is port 80.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Run the container with a host mapping. For access from the same machine only, use:
docker run --rm -p 127.0.0.1:8080:80 nginx -
Open
http://localhost:8080in a browser on the Docker host. Docker forwards that connection to port 80 in the container. -
If you deliberately need to bind on all host addresses instead, use
docker run --rm -p 8080:80 nginxand account for the exposure in your host network and firewall configuration.
For Docker Compose, declare the equivalent mapping under the service’s ports key:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →ports: Docker port publishing documentation
- "127.0.0.1:8080:80"
Use a fixed or Docker-selected host port
When you specify both ports, Docker uses the host port you chose. Host and container numbers need not match: -p 8080:80 sends host connections to 8080 to container port 80. To ask Docker to select an available host port for container port 80, omit the host port:
docker run -p 80 nginx
Use docker ps or docker port to inspect the resulting mapping and find the selected host port. The -P option is different: it publishes ports declared as exposed by the image on automatically selected host ports. It does not publish every port a running process happens to open. Docker Docs: Publishing and exposing ports
Understand EXPOSE, -p, and -P
EXPOSE in a Dockerfile documents a port the image’s application uses; it does not, by itself, make that port reachable on the host. The --expose option likewise declares a container port without creating a host mapping.
EXPOSE: documents a container port in the image.--expose: declares a container port at runtime, without publishing it on a host port.-p/--publish: creates an explicit host-to-container mapping.-P/--publish-all: publishes the image’s exposed ports on Docker-selected host ports.
For a predictable local URL, use -p with an explicit host port rather than relying on -P. Docker Docs: Publishing and exposing ports
Best Value
Specify TCP or UDP when needed
TCP is the usual default for a published port. To publish a UDP service, include the protocol in the mapping, such as -p 8080:80/udp. Choose the protocol the application actually uses; publishing the wrong one will not make the intended service reachable. Docker supports protocol-specific port mappings. Docker Engine documentation
Do not confuse published ports with container-to-host access
Publishing with -p is for a client on the host (or another reachable machine) connecting to a service in the container. The reverse direction—an application in a Docker Desktop container connecting to a service running on the host—uses host.docker.internal. Docker Desktop networking
Quick Recap
When -p does not work
- Check the application and its listening port. The process must be running and listening on the container port named in the mapping. Publishing container port 80 will not reach an application listening on a different port.
- Check the order. In
-p 8080:80, 8080 is the host port and 80 is the container port. - Inspect the actual mapping. Use
docker psordocker port, especially when you used-p CONTAINER_PORTor-Pand Docker selected the host port. - Check for a host-port conflict. If another process already occupies a requested host port, choose a different host port or let Docker select one.
- Check the bind address and firewall. An omitted host address means all host interfaces by default. A loopback binding is more restrictive, while firewall and network configuration can affect reachability.
- Check the network mode. With host network mode,
-pis ignored: the container shares the host network namespace and its process binds directly to host ports. Docker host network driver
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute
