n docker

Docker containers and published port mapping

Usage — n docker

═══════════════════════════════════════════════════════════════════════════════
  Netscrew ("n") — docker (d, dock, containers) — Docker containers & published ports
═══════════════════════════════════════════════════════════════════════════════

USAGE:
  n d .                                list running containers
  n d . <name>                         inspect one container

Target: . = this machine · <host> = remote
Deeper: n d -h = the concept/theory behind this command

The concept behind it — n docker -h

═══════════════════════════════════════════════════════════════════════════════
  NETSCREW GUIDE: Docker Port Mapping & Container Networking ("n d")
═══════════════════════════════════════════════════════════════════════════════

HOW DOCKER PORT PUBLISHING WORKS:
  When a container runs with -p <HOST_PORT>:<CONTAINER_PORT>:
  1. Docker binds a helper process (docker-proxy) to the host port.
  2. Docker injects DNAT iptables / nftables firewall rules to forward incoming
     traffic from the host network interface to the container's virtual IP (e.g. 172.18.0.2).

PORT BINDING NOTATIONS:
  • 0.0.0.0:8080->80/tcp : Published to ALL IPv4 interfaces (LAN & Public reachable).
  • [::]:8080->80/tcp    : Published to ALL IPv6 interfaces.
  • 127.0.0.1:8080->80/tcp : Bound ONLY to localhost (secure, invisible to LAN).
  • 80/tcp (no arrow)     : Exposed internally to other containers on the same Docker
                             network, but NOT accessible from the host or LAN.

COMMON PITFALLS & SOLUTIONS:
  • "bind: address already in use": Another container or host service is hogging
    that port. Run n p . <PORT> to see the culprit PID or conflicting container!
  • docker-proxy Noise: Traditional netstat/ss commands list "docker-proxy"
    for every container port. Netscrew automatically resolves the REAL container name
    (e.g., "qbittorrent", "nextcloud") and image!
  • Host-Mode Containers: Containers run with --network host share the host's
    network stack directly without docker-proxy or port translation.

COMMAND SHORTCUTS:
  • n d             List all running containers and published host ports
  • n d <NAME>      Inspect internal IP, gateway, MAC, and all port bindings
  • n web           Probe web services inside containers and generate clickable URLs