Britixo CRMBritixo CRMEnterprise Help Centre
Ctrl K
Shared server guidance · Question & answer

How do I publish a Docker web port only on localhost?

Specify the host loopback address when a container’s published port is intended only for a local reverse proxy or local diagnostic client. Omitting the host address commonly publishes on all host addresses. Docker’s packet-routing rules also mean an ordinary UFW rule should not be assumed to restrict a published container port.

IntermediateMaintained Linux Docker Engine versionsThe documented localhost isolation fix requires Docker 28.0.0 or later

Britixo Help Centre · Updated

Go to the answer

Before you start

  • Permission to create a demonstration container.
  • An unused container name and local TCP port.
  • An approved image source; production deployments should use the approved immutable image reference.

Instructions

1. Check for a port collision

Confirm that 8080 is available and that an existing deployment does not already own the example container name. Use the application’s deployment system for a real production service.

Remote Linux shell
ss -lnt 'sport = :8080'
docker ps --all --filter name=example-web

Inspects the example local port and container name.

2. Create a loopback-bound demonstration

This example starts the official Nginx image for demonstration. The stable tag can change over time; substitute the vetted pinned reference in a production deployment.

Remote Linux shell
docker run --name example-web --detach --publish 127.0.0.1:8080:80 nginx:stable

Creates a container with host loopback TCP 8080 mapped to container TCP 80.

3. Verify the mapping and response

Check the explicit binding and local response, then verify from an authorised separate host that the backend port is not directly reachable.

Remote Linux shell
docker port example-web
curl --head --max-time 10 http://127.0.0.1:8080/

Displays published ports and tests the local web endpoint.

Check the result

  • The mapping is explicitly loopback-bound and the local proxy or client can reach it while unintended remote access is blocked.

Troubleshooting

The backend is still reachable remotely
Check Docker version, direct-routing settings and other mappings. Versions before 28.0.0 have a documented same-L2-network localhost exposure caveat.

Official references

Use the documentation for your installed version when a flag, service name or platform feature differs.