An application listener, a container network endpoint and a host published endpoint are different pieces of a request path. EXPOSE 8000 describes intended image port usage; it does not publish a port on the host. A runtime mapping such as -p 127.0.0.1:9000:8000/tcp selects host address 127.0.0.1, host port 9000 and container port 8000. The browser uses the host endpoint; the application listens on the container-side number.
This lesson deliberately models one ordinary IPv4 bridge path. It does not implement routing, firewall rules, IPv6, host networking or actual socket availability. An audit can reject a contradictory plan without proving that a real packet will arrive.
Trace the request inward
First ask which host address should accept traffic. A loopback-only host mapping is useful for local practice because it avoids intentionally publishing on every host interface. Next ask which port the mapping targets inside the container. Finally inspect the application's bind address. In a bridge network, a packet arrives through a container interface; a process listening only on the container's 127.0.0.1 is not listening on that interface.
It is therefore consistent to publish on host 127.0.0.1 while making the application listen on container 0.0.0.0. The two addresses operate in different network namespaces. A health probe running inside the container can reach its own loopback listener even when the externally published path fails. That mismatch is a reason to investigate configuration, not to declare the network healthy from one probe.
Keep fields explicit
binding = {"host_ip":"127.0.0.1", "host_port":9000,
"container_port":8000, "protocol":"tcp"}
print("{host_ip}:{host_port}:{container_port}/{protocol}".format(**binding))
app_host, app_port = "0.0.0.0", 8000
print(app_host == "0.0.0.0" and app_port == binding["container_port"])The first build function renders publishing arguments only after validation. Ports must be integers in range, not booleans or strings. Keeping protocol explicit permits the same numeric port once for TCP and once for UDP. The course conservatively reserves a (host_port, protocol) pair across all modeled host addresses; real operating-system and daemon binding rules can distinguish more cases. State that policy instead of pretending it is a universal socket rule.
The second function answers only whether a stated listener matches the modeled incoming bridge path. It does not check whether a process exists, whether the protocol matches a real listener, whether another program has taken the host port, or whether the environment allows the connection.
Diagnose from a chain of evidence
Before building, explain why a correct EXPOSE line cannot compensate for a wrong application bind address. Then change only the host port, only the container port and only the listener address; predict which change affects each part of the path. The two bug hunts reverse the destination number and conflate the two loopback boundaries.
In optional local Docker practice, verify an actual HTTP response as well as the process and health state. For remote access, choose an exposure policy deliberately and review the host's networking setup. Passing the offline lab establishes field validation and path reasoning, not network isolation or production readiness.