---
title: "Publish only the ports visitors use · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/published-ports
id: INF-76
level: Required
applies: servers
risk: data
updated: 2026-10-27
build: a2a6bdfed830
tokens: 955
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Publish only the ports visitors use

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Containers and orchestration](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: INF-76
- Level: Required
- Chapter: [Containers and orchestration](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration.md)
- Rule: Expose a container port beyond its host or cluster only when visitors must reach it. Bind every other published port to 127.0.0.1, or keep it inside the cluster.
- Check: On a single host, `docker ps --format '{{.Names}} {{.Ports}}'` shows `0.0.0.0` or `[::]` only on the proxy's ports, TCP 80 and 443 and UDP 443 for HTTP/3. On Kubernetes, `kubectl get svc -A` lists `LoadBalancer` or `NodePort` only for the ingress. A TCP and UDP port scan from outside finds no other open port, except the host's SSH port.
- Risk: Data leaked or lost
- Applies when: The project runs its own servers, virtual machines or containers.
- How: Docker publishes ports on every host address by default. Its own rules route that traffic before a host firewall such as ufw sees it. So a database port published for a quick test is open to the internet, whatever the host firewall says. Containers on a shared network reach each other without any published port. Write `127.0.0.1:5432:5432` when only the host needs the port. Run Docker Engine 28 or later, because older releases let machines on the same local network reach ports bound to localhost. On Kubernetes, give internal services the type `ClusterIP`. Avoid `NodePort`, `hostPort` and `hostNetwork`, which open a port on every node or bypass the cluster network. Only the ingress or one load balancer service faces the internet. Close the rest in the cloud firewall as [Deny all traffic unless a rule allows it](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/deny-by-default-firewall.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### YAML example

```yaml
services:
  proxy:
    ports: ["80:80", "443:443"]
  db:
    image: postgres:17.11-alpine
    ports: ["127.0.0.1:5432:5432"]
```

### Shell example

```sh
docker run -p 127.0.0.1:8080:80 -p '[::1]:8080:80' shop
```

## Sources

- [Docker port publishing and mapping](https://docs.docker.com/engine/network/port-publishing/)
- [Docker packet filtering and firewalls](https://docs.docker.com/engine/network/packet-filtering-firewalls/)

## Related rules

- INF-30 [Deny all traffic unless a rule allows it](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/deny-by-default-firewall.md) in Infrastructure and environments

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/published-ports">Agent Wranglers infrastructure and environments playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Make the container file system read-only](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/read-only-containers.md)
- Next: [Put each container only on the networks it needs](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/container-networks.md)
- [Containers and orchestration](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration.md)