You can find the configuration for these ports (usually 32768 to 61000) in /proc/sys/net/ipv4/ip_local_port_range. Docker maps all of these ports to a host port within a given epehmeral port range. Docker also finds ports you expose with -expose 8080 (assuming you want to expose port 8080). If you append -P (or -publish-all=true) to docker run, Docker identifies every port the Dockerfile exposes (you can see which ones by looking at the EXPOSE lines). Every outgoing connection appears to originate from the host’s IP space Docker creates a custom iptables masquerading rule.
How this worksĪ bridge network is created (with the name bridge) when you install Docker. Getting Started Binding Ports Binding Portsĭocker containers can connect to the outside world without further configuration, but the outside world cannot connect to Docker containers by default.
