Live Re-homing & Port Internals

Changing Networks Without Downtime

A container can join and leave networks while running - each connection is just another network interface inside it:

$ docker network connect pci-zone pci-db      # add an interface
$ docker network disconnect shared pci-db     # remove one

Scenario: The audit says your cardholder DB can't share a network with the public web tier. With connect/disconnect you segment it live - no restart, no maintenance window. (That's the Segment the Network lab.)

A container on two networks is also the standard pattern for a reverse proxy: one leg on the public-facing network, one leg on the internal app network - the only bridge between zones.

What -p Actually Does

Publishing a port programs the host's firewall (iptables/nftables DNAT) and starts a userland proxy:

client ──▶ host:8080 ──DNAT──▶ 172.17.0.2:80

Practical consequences:

• -p 8080:80 binds 0.0.0.0 - every interface. On an internet-facing host, that's public! Restrict with -p 127.0.0.1:8080:80 and put a reverse proxy in front.
• Two containers can't publish the same host port ("port is already allocated").
• Container-to-container traffic on a shared network never uses published ports - it goes straight to the container IP.

Danger: -p 5432:5432 on a cloud VM has leaked more databases than any exploit. Publishing to 0.0.0.0 bypasses typical host firewall configs because Docker writes its own rules. Bind to 127.0.0.1 unless the port truly must be public.