Publish only the ports visitors use

How to do it

Docker publishes ports on every host address by default. Its own rules route that traffic before a host firewall such as ufw sees it. So a database port published for a quick test is open to the internet, whatever the host firewall says. Containers on a shared network reach each other without any published port. Write 127.0.0.1:5432:5432 when only the host needs the port. Run Docker Engine 28 or later, because older releases let machines on the same local network reach ports bound to localhost. On Kubernetes, give internal services the type ClusterIP. Avoid NodePort, hostPort and hostNetwork, which open a port on every node or bypass the cluster network. Only the ingress or one load balancer service faces the internet. Close the rest in the cloud firewall as Deny all traffic unless a rule allows it says.

Examples

YAML example

services:
  proxy:
    ports: ["80:80", "443:443"]
  db:
    image: postgres:17.11-alpine
    ports: ["127.0.0.1:5432:5432"]

Shell example

docker run -p 127.0.0.1:8080:80 -p '[::1]:8080:80' shop

How to check

On a single host, docker ps --format '{{.Names}} {{.Ports}}' shows 0.0.0.0 or [::] only on the proxy's ports, TCP 80 and 443 and UDP 443 for HTTP/3. On Kubernetes, kubectl get svc -A lists LoadBalancer or NodePort only for the ingress. A TCP and UDP port scan from outside finds no other open port, except the host's SSH port.

Sources

• Docker port publishing and mapping
• Docker packet filtering and firewalls

Related rules

• INF-30 Deny all traffic unless a rule allows it in Infrastructure and environments