Does EXPOSE in a Dockerfile make a port reachable from outside?
No. EXPOSE is only documentation of the port the app listens on. To make it reachable from the host you must publish it with -p, or -P to publish all exposed ports to random host ports.
Explain it simply
EXPOSE is the sign on a shop saying 'billing counter: window 3'. It tells people where to go, but does not open the door. Publishing with -p is actually unlocking the door to the street.
EXPOSE 8080 records metadata so that humans and tools know the app listens on 8080. Containers on the same user-defined network can reach each other on any port anyway, whether exposed or not. For the outside world, docker run -p 80:8080 maps host port 80 to container port 8080. docker run -P maps every EXPOSEd port to a random free host port, which you can see in docker ps.
So a container with EXPOSE but no -p is not reachable from your browser, while a container with -p but no EXPOSE works fine.
Example
# Dockerfile has: EXPOSE 8080
docker run -d myapp # not reachable from the host
docker run -d -p 3000:8080 myapp # reachable at localhost:3000
docker run -d -P myapp # random host port
docker port <container>What to say in the interview
"EXPOSE only documents the port. Reachability from the host requires -p host:container, or -P for random host ports. Between containers on the same network, ports are reachable without either."
Common mistakes
- Thinking EXPOSE alone makes the app available at localhost.