How do you publish a container port only on localhost, not to the whole network?
Bind the host side to the loopback address: docker run -p 127.0.0.1:8080:80. By default -p 8080:80 listens on all interfaces, so anyone on your network can reach it.
Explain it simply
A port published as 8080:80 is like opening your room window to the whole street. Prefixing 127.0.0.1 closes the window to the street but leaves a private peephole for you.
The full form of -p is ip:hostPort:containerPort. Leaving the IP out means 0.0.0.0, every network interface. On college Wi-Fi or a cloud VM with a public IP, that can expose a development database to strangers. With 127.0.0.1: only processes on the same machine, like your browser or a reverse proxy, can connect. Another point: Docker adds its own firewall rules, which can bypass tools like ufw, so do not rely on the host firewall alone.
For a database that only another container needs, publish nothing at all.
Example
docker run -d -p 127.0.0.1:5432:5432 postgres:16 # local only
docker run -d -p 5432:5432 postgres:16 # all interfaces
docker ps # compare PORTS columnWhat to say in the interview
"I use -p 127.0.0.1:host:container to limit exposure to the local machine. Plain -p binds to all interfaces, and Docker's firewall rules can bypass ufw, so for internal services I publish no port at all."
Common mistakes
- Running a database with -p 5432:5432 on a cloud VM with a public IP.