In the manual there is such code:

dev@ubuntu:~$ docker run -d -p 5050:5000 training/webapp python app.py

Quote description:

With this command, docker automatically finds the image of training / webapp in the official repository, downloads it and all the necessary layers, starts the container and the app.py application as a daemon (-d). All this looks to the external world through port 5050 and to the internal world (for communicating containers with each other) through port 5000 (-p 5050: 5000).

So after the launch of the container, you can open the browser, there is localhost:5050 and it will output 'Hello World!'. It's clear. This is a call to the external port of the container. And what is the internal port 5000? What does it mean to communicate containers with each other? If, for example, to launch the 2nd container, for example with a browser, will it be necessary to write localhost:5000 for output in this browser from the container of our 'Hello World'? I understand correctly? But if so, why not to 5050? After all, in fact, another container for the 1st is also an external application, just like the browser from the host system?

    1 answer 1

    • When you start a container, the application inside the container also runs on a specific port. Forwarding the external to the internal port occurs due to NAT through iptables (one of the options).
    • For internal message containers - this means that if you run 2 containers, you can make it so that they will communicate with each other directly - bypassing iptables and NAT. This is very often used to connect a web application to a database. One container is an application, the second is a database. The database opens the internal port (for example, 3306 for mysql) and the application connects to the internal port that opened the database.
    • If you launch the second container, you will not be able to use external port 5000 for the second container if the first one is already running.

    In general, the idea of ​​an internal port for a container is just an isolated port from the main system.