How to expose docker container's ip and port to outside docker host without port mapping?

In Docker, if you don't expose container ports via port mapping (i.e., the -p flag), you can still make the container's services accessible from the outside using the following methods:

1. Using Host Network Mode

When you run a container in host network mode, the container does not have its own IP address and directly uses the host's network. This means the container's network interface is identical to the host's. Consequently, applications within the container can directly access the host's IP address and port without port mapping.

For example, run a web server container in host network mode:

bash
docker run --network host -d nginx

In this case, if the host's IP address is 192.168.1.5, accessing http://192.168.1.5 in a browser will directly reach the nginx server running in the container.

2. Using MacVLAN Network

MacVLAN networks allow containers to have independent MAC addresses and connect directly to the physical network. With MacVLAN, containers obtain their own IP address on the network, similar to a physical machine, enabling direct access by other devices on the same network.

First, create a MacVLAN network:

bash
docker network create -d macvlan \n  --subnet=192.168.1.0/24 \n  --gateway=192.168.1.1 \n  -o parent=eth0 pub_net

Then, run the container and connect it to the newly created network:

bash
docker run --network pub_net -d nginx

In this setup, the container will obtain an available IP address within the 192.168.1.0/24 subnet, which can be directly accessed by other devices on the same network.

3. Using Routing and Firewall Rules

If the above methods are not suitable for your environment, you can achieve this by configuring routing and firewall rules on the host. This typically involves setting up NAT (Network Address Translation) and IP forwarding rules.

First, ensure IP forwarding is enabled on the host:

bash
sysctl -w net.ipv4.ip_forward=1

Then, use iptables to add NAT rules that forward requests to the container:

bash
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination <container IP>:80
iptables -t nat -A POSTROUTING -j MASQUERADE

The above commands forward all TCP requests to port 80 on the host to port 80 on the container.

Summary

Each method has its pros and cons. Host network mode is simple but shares the network environment with the host. MacVLAN provides better isolation but requires relatively complex configuration. Using routing and firewall rules offers the greatest flexibility but demands deeper network knowledge. Choose the most suitable method based on your specific requirements and environment.