A published container port is a host networking decision, not merely a container setting. If the host address is omitted, Docker documents publication on host addresses; binding to 127.0.0.1 limits access to the host, after which a reverse proxy or private access layer can provide the intended route.
What decision should an operator make?
- Public service: publish only the intended port and explicitly document the public edge.
- Private web app: bind to localhost or a private interface, then put the proxy or mesh on the allowed path.
- Host-only helper: avoid publication when a container network or local socket is enough.
- Uncertain: do not publish until the listener, firewall, cloud security group, and proxy path are mapped.
Examples are deliberately illustrative rather than test output:
services:
app:
ports:
- "127.0.0.1:8080:8080"Are Docker and Podman identical here?
No. Both can publish ports, but defaults, networking backends, rootless behavior, firewall interaction, and command syntax can differ by runtime and version. Read the runtime’s documentation and verify the resulting listener on the stated host.
A localhost bind is not a complete security model: local users, host processes, proxy misconfiguration, and IPv6 behavior still matter. Pair this guide with Docker port binding and Docker/UFW exposure.