I'm learning Docker and Kubernetes and was told that EXPOSE in a Dockerfile and containerPort in a Kubernetes Pod specification are only documentation. Is that completely accurate? If neither directive actually opens or publishes a port, what makes the application reachable, and why are these fields useful?
4 Answers
For Docker, EXPOSE mainly records the port as image metadata. It does not publish the port or create a firewall rule. The application still has to listen on that port, and you publish it at runtime with something like `docker run -p 8080:8080`. Docker can also use EXPOSE as a hint with automatic publishing options such as `-P`, and tools can inspect the metadata.
A useful mental model is that a container has its own Linux network namespace. There is no special gate that must be opened by EXPOSE or `containerPort`; a process simply binds to a socket, just as it would on a normal host. Routing, port publishing, firewall rules, and Kubernetes Services determine whether traffic from other networks can reach that socket.
Kubernetes is similar, but `containerPort` is not entirely useless documentation. A Pod’s network namespace already accepts traffic sent to the Pod IP; the application must be listening on the port. To make it reachable through a stable address or from outside the cluster, you normally create a Service, Ingress, or another Kubernetes networking resource. A Service can also use a named container port as its `targetPort`, for example mapping Service port 80 to a container port named `http`.
The fields are also useful to integrations. Monitoring systems, deployment tools, and other automation may inspect `containerPort` or image metadata to infer intended ports. That does not guarantee that anything will scrape or route traffic automatically, though, so you should check the behavior of the specific tool.
So the field itself does not open the port, but naming the port can let a Service refer to it instead of repeating the number. The application still needs to listen on that port, and the Service provides the routing.