In Docker, do I need to publish ports if I set network to host?

I was running into an issue today where I have a Dockerfile that EXPOSEs several ports and I wanted to run it with the --net=host flag.

However, all connections to the ports that the container was supposed to be listening on were refused.

  • Log client's “real” IP address in Docker Swarm 1.12 when accessing a service
  • How to provision Docker images in Vagrant?
  • Cant connect to postgres docker container in docker compose
  • Share Existing Host Directory with Docker Container?
  • Build Java Gradle project within a Docker container?
  • What is the default working directory when running a mesos chronos command
  • Running docker inspect on the container I noticed this:

            "Ports": {
                "8000/tcp": {},

    Growing exasperated I deleted the --net flag all together and went to the default bridge network. Surprise it works!

        "Ports": {
            "8000/tcp": null,

    Except now it has this strange null setting. What is the difference here? Also, plot I’m running inside of a VM trying to communicate with another VM. Probably a million reasons this won’t work.

  • How to fix cadvisor error `devicemapper filesystem stats will not be reported`?
  • Using docker and docker-compose in order to run npm install and bower install
  • COPY of existing file in Dockerfile fails mysteriously
  • How can I edit my image tags on docker hub?
  • Running docker commands in bash script leads to segmentation fault
  • Access docker container from host using containers name
  • One Solution collect form web for “In Docker, do I need to publish ports if I set network to host?”


    Is the publish option needed when the network mode is host?


    No, the host network stack is directly used by the container:

    'host': use the Docker host network stack. Note: the host mode gives the container full access to local system services such as D-bus and is therefore considered insecure.


    Start a container with netcat:

    user@host:~$ docker run -it --rm --net host nc:1.10-41
    root@container:/# nc -l -p 9999

    Back into the host:

    user@host:~$ nc 9999
    Sending a message for test <enter>

    The message will be displayed from the netcat command executed within the container.


    A  netstat from the host will show the established connection:

    user@host:~$ netstat latuep |grep 9999
    tcp        0      0 localhost:38600         localhost:9999          ESTABLISHED
    tcp        0      0 localhost:9999          localhost:38600         ESTABLISHED

    As for your issue

    The error may stem from another configuration/network environment. Can VMs ping each other? Do they share the same LAN? Is a firewall set?

    Docker will be the best open platform for developers and sysadmins to build, ship, and run distributed applications.