Host Networking and Port Publishing

The host network driver removes the network namespace isolation between the container and the host. The container binds directly to the host's network interfaces — EXPOSE 3000 in the image means the process listens on host:3000 without any -p flag. This eliminates NAT overhead and provides the lowest possible network latency, which matters for high-throughput or latency-sensitive applications. The downside of host networking is that two containers cannot both listen on the same port, and the container inherits all host network interfaces. Host networking is only supported on Linux; Docker Desktop on macOS and Windows does not support it. For most applications, a user-defined bridge network is the better default. With bridge networking, publishing a port binds a host port to a container port. Using the extended syntax 127.0.0.1:3000:3000/tcp restricts the host binding to localhost and specifies the protocol, enabling precise control over which services are externally accessible.

Example

# Host networking (Linux only)
docker run -d \
  --name api-host \
  --network host \
  -e PORT=3000 \
  myapp:latest
# Container listens directly on host:3000, no -p needed

# Bind to all interfaces (default, publicly accessible)
docker run -d -p 3000:3000 myapp:latest

# Bind to localhost only (proxied by Nginx)
docker run -d -p 127.0.0.1:3000:3000 myapp:latest

# Map multiple ports
docker run -d \
  -p 127.0.0.1:3000:3000 \
  -p 127.0.0.1:9229:9229 \
  myapp:dev

# Random host port (Docker assigns it)
docker run -d -p 3000 myapp:latest
docker port <container_id>

# Inspect port mappings
docker ps --format "table {{.Names}}\t{{.Ports}}"
docker port api

# Fully isolated container (no network)
docker run --rm --network none alpine ping google.com

HTML

Full Editor

Related Resources

Docker Reference

Complete tag & property list

Docker How-To Guides

Step-by-step practical guides

Docker Exercises

Practice what you've learned