Docker 端口映射是主机到容器还是容器到主机？

Question

I use Docker port-mappings often to map a host port to a container port, ie traffic sent to the host port is forwarded to the container port.

This can be seen as a host-to-contaner mapping of ports.

What confuses me is that many articles talk about mapping container ports to host ports, ie the reverse mapping.

Furthermore, docker ps lists host-to-container port mappings, while docker port lists container-tohost port mappings:

$ docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                      NAMES
5526355f9c75        ubuntu:latest       "/bin/bash"              55 seconds ago      Up 54 seconds       127.0.0.1:4444->8080/tcp   angry_tharp

$ docker port angry_tharp
8080/tcp -> 127.0.0.1:4444

Why all this confusion with the direction of the port mapping? Are host-to-container port mappings any different form container-to-host port mappings, or are they the same?

Answer 1

host-to-container and container-to-host port mappings are exactly the same. You can see this is true just by looking at your two examples. The ports are reversed, so the mappings are the exact same.

Docker port shows the port mappings in relation to the container, whilst docker ls / ps shows it in relation to the host. Why? Not sure, but that doesn't change the mappings.

From their official docs, which I personally think has precedence over any unofficial article:

Flag value  Description
-p 8080:80  Map TCP port 80 in the container to port 8080 on the Docker host.
-p 192.168.1.100:8080:80    Map TCP port 80 in the container to port 8080 on the Docker host for connections to host IP 192.168.1.100.
-p 8080:80/udp  Map UDP port 80 in the container to port 8080 on the Docker host.
-p 8080:80/tcp -p 8080:80/udp   Map TCP port 80 in the container to TCP port 8080 on the Docker host, and map UDP port 80 in the container to UDP port 8080 on the Docker host.

They always mention the mappings as host-to-container.

Answer 2

A docker port mapping exposes a port from within the container to the host. So what you call a "host-to-container" could as well be worded "container-to-host": it depends of the point of view.

Let's pretend we are a network packet. When arriving on the host, we are forwarded to the container. That is "host-to-container".

But now let's pretend we are the running service inside the container. When we start, be bind to the container port, which is mapped to the host's. So in a way that is "container-to-host".

You get the idea: that's the same thing.