Managing container ports

Now that we know how we can isolate firewall containers from each other by placing them on different networks, and that we can have a container attached to more than one network, we have one problem that remains unsolved. How can we expose an application service to the outside world? Imagine a container running a web server hosting our webAPI from before. We want customers from the internet to be able to access this API. We have designed it to be a publicly accessible API. To achieve this, we have to, figuratively speaking, open a gate in our firewall through which we can funnel external traffic to our API. For security reasons, we don’t just want to open the doors wide; we want to have a single controlled gate that traffic flows through.

We can create this kind of gate by mapping a container port to an available port on the host. We’re also calling this container port to publish a port. Remember that the container has its own virtual network...