Port Publishing Security, Inter-Container Communication, and IP Address Allocation

| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | `-p 8080:80` | Map port `8080` on the Docker host to TCP port `80` in the container. | | `-p 192.168.1.100:8080:80` | Map port `8080` on the Docker host IP `192.168.1.100` to TCP port `80` in the container. | | `-p 8080:80/udp` | Map port `8080` on the Docker host to UDP port `80` in the container. | | `-p 8080:80/tcp -p 8080:80/udp` | Map TCP port `8080` on the Docker host to TCP port `80` in the container, and map UDP port `8080` on the Docker host to UDP port `80` in the container. | > [!IMPORTANT] > > Publishing container ports is insecure by default. Meaning, when you publish > a container's ports it becomes available not only to the Docker host, but to > the outside world as well. > > If you include the localhost IP address (`127.0.0.1`, or `::1`) with the > publish flag, only the Docker host and its containers can access the > published container port. > > ```console > $ docker run -p 127.0.0.1:8080:80 -p '[::1]:8080:80' nginx > ``` > > > [!WARNING] > > > > In releases older than 28.0.0, hosts within the same L2 segment (for example, > > hosts connected to the same network switch) can reach ports published to localhost. > > For more information, see > > [moby/moby#45610](https://github.com/moby/moby/issues/45610) If you want to make a container accessible to other containers, it isn't necessary to publish the container's ports. You can enable inter-container communication by connecting the containers to the same network, usually a [bridge network](./drivers/bridge.md). Ports on the host's IPv6 addresses will map to the container's IPv4 address if no host IP is given in a port mapping, the bridge network is IPv4-only, and `--userland-proxy=true` (default). For more information about port mapping, including how to disable it and use direct routing to containers, see [packet filtering and firewalls](./packet-filtering-firewalls.md). ## IP address and hostname When creating a network, IPv4 address allocation is enabled by default, it can be disabled using `--ipv4=false`. IPv6 address allocation can be enabled using `--ipv6`. ```console $ docker network create --ipv6 --ipv4=false v6net ``` By default, the container gets an IP address for every Docker network it attaches to. A container receives an IP address out of the IP subnet of the network. The Docker daemon performs dynamic subnetting and IP address allocation for containers. Each network also has a default subnet mask and gateway. You can connect a running container to multiple networks, either by passing the `--network` flag multiple times when creating the container, or using the `docker network connect` command for already running containers. In both cases, you can use the `--ip` or `--ip6` flags to specify the container's IP address on that particular network. In the same way, a container's hostname defaults to be the container's ID in Docker.

This section emphasizes the importance of securing published container ports by specifying the localhost IP address to restrict access. It explains that inter-container communication can be achieved by connecting containers to the same network, eliminating the need for port publishing. It also describes how IPv4 and IPv6 address allocation works by default, and how to assign static IP addresses to containers using the `--ip` or `--ip6` flags when connecting them to networks.