What Is Port Mapping in Docker?
Learn what port mapping is in Docker, how the -p flag forwards host traffic into a container port, and how iptables NAT rules make it happen.
Expected Interview Answer
Port mapping is the process of publishing a container's internal port to a port on the host machine, using the -p flag, so that traffic hitting the host can be forwarded into the isolated container network.
By default, a container's ports are only reachable from other containers on the same Docker network, not from outside the host, because containers live in their own isolated network namespace. Running `docker run -p 8080:80 nginx` tells Docker's networking layer to forward connections arriving at the host's port 8080 to port 80 inside the container, using iptables NAT rules under the bridge driver. You can also bind to a specific host interface, publish a range of ports, or let Docker pick a random host port with -P, and multiple containers can each map to different host ports even if they all listen on the same internal port.
- Exposes containerized services to clients outside the host
- Lets multiple containers share one host port range without conflicts
- Keeps internal container networking isolated by default, which is safer
- Supports binding to specific host interfaces for tighter control
- Works consistently whether run manually or via Compose
AI Mentor Explanation
Port mapping is like assigning a stadium's public gate number to a specific dressing room door outsiders cannot normally reach. A steward at gate eight forwards ticket holders straight to the home team's inner corridor, while gate nine sends fans to the away corridor instead. Without that gate assignment, spectators outside the stadium walls would have no path into either dressing room.
Step-by-Step Explanation
Step 1
Container listens internally
The application inside the container binds to a port on its own isolated network namespace, such as port 80.
Step 2
Publish with -p
Running docker run -p HOST:CONTAINER, e.g. -p 8080:80, tells Docker to publish that container port to the host.
Step 3
NAT rule is created
Under the bridge driver, Docker adds an iptables DNAT rule forwarding host port 8080 traffic into the container's port 80.
Step 4
External traffic arrives
A client connects to the host's IP on port 8080, and the kernel forwards the packets into the container's network namespace.
Step 5
Multiple containers, distinct host ports
Other containers can each bind their own internal port 80 too, as long as they are published to different, non-conflicting host ports.
What Interviewer Expects
- Explains that container ports are isolated and not reachable externally by default
- Understands the HOST:CONTAINER syntax of the -p flag
- Knows Docker uses iptables NAT rules under the bridge driver to implement mapping
- Can explain host port conflicts when running multiple containers
- Mentions -P for random port assignment and binding to a specific host interface
Common Mistakes
- Reversing the -p flag order and mapping CONTAINER:HOST instead of HOST:CONTAINER
- Assuming EXPOSE in a Dockerfile alone makes a port reachable from outside the host
- Forgetting that host networking mode bypasses port mapping entirely
- Trying to map two different containers to the same host port simultaneously
Best Answer (HR Friendly)
“Port mapping connects a port on the host computer to a port inside a container, similar to forwarding calls from a public phone line to a specific desk inside a building. Without it, an application running in a container would be completely unreachable from outside that container.”
Code Example
# Map host port 8080 to the container's port 80
docker run -d --name web -p 8080:80 nginx:latest
# Map to a specific host interface only
docker run -d -p 127.0.0.1:9090:80 nginx:latest
# Let Docker choose a random available host port
docker run -d -P nginx:latest
# See the actual host port assigned
docker port webFollow-up Questions
- What is the difference between the -p and -P flags in docker run?
- How does Docker implement port mapping under the bridge network driver?
- Does EXPOSE in a Dockerfile actually publish a port to the host?
- How do you avoid host port conflicts when running many containers?
- How does port mapping behave differently under host networking mode?
MCQ Practice
1. What does `docker run -p 8080:80 nginx` do?
The -p flag syntax is HOST:CONTAINER, so host port 8080 is forwarded to the container's port 80.
2. By default, can an external client reach a container's port without mapping?
Containers live in an isolated network namespace, so their ports are unreachable externally until published with -p.
3. What does the -P flag do differently from -p?
-P publishes all ports listed in EXPOSE, assigning each a random available host port automatically.
Flash Cards
What is port mapping in Docker? — Publishing a container's internal port to a port on the host so outside traffic can reach it.
What is the syntax order for the -p flag? — HOST:CONTAINER, e.g. -p 8080:80 maps host port 8080 to container port 80.
Does EXPOSE alone publish a port to the host? — No, EXPOSE is documentation; -p or -P actually publishes the port.
What mechanism implements port mapping under the bridge driver? — iptables NAT (DNAT) rules that forward host traffic into the container's namespace.