0

I create a docker image for openvpn. But when I use docker inspect command to get config from this image, I always see this setting in ContainerConfig:

"ContainerConfig": {
        "Hostname": "cfd8618fa650",          
        "ExposedPorts": {
            "11194/tcp": {}
        },

This is not good because every time I run this image, it will expose port 11194 automatically even I didn't want to. Does any one know how to remove this config ?

Tamas Rev
  • 7,008
  • 5
  • 32
  • 49
Henry
  • 1
  • Post your Dockerfile and your `docker run` – user2915097 Apr 05 '17 at 05:31
  • Exposing a port (as I just learned myself) is not the same as publishing it. The exposed port is only accessible to other containers and not to the host. In order to access one container from the other you need to add them to an overlay network, link them or something similar. You can not by default access one container from the other without some connection between them. So actually you could leave this port exposed. See this [post](http://stackoverflow.com/questions/22111060/difference-between-expose-and-publish-in-docker) or google understanding container communication. – herm Apr 07 '17 at 14:26

1 Answers1

0

Pay attention that 11194 is the default OpenVpn port, so it's quite normal that it's exposed by Docker.

Anyway, if you have the Dockerfile, obviously you can build a new image removing the EXPOSE 11194 line from Dockerfile itself.

But if you run an image directly pulling it from a repo, or you can't remove the container, the port will be exposed, but you can bind it to a specific ip.

Because port mapping -p format can be

ip:hostPort:containerPort | ip::containerPort | hostPort:containerPort | containerPort

you can bind the host port to a single host (e.g. localhost) instead to all the world, for example

docker run -p 127.0.0.1:11194:11194 ...

So port 11194 (or whatever port number you assign locally) will be reachable from localhost only.

Otherwise you can close the port by iptables or other firewall.

The site Docker and IPtables explains well docker port binding, iptables forwarding rules, etc.

gile
  • 5,580
  • 1
  • 25
  • 31