Docker port configuration for external access

Question

i have a problem with Docker in my project. My project have several processes, and one of them is a website. This website is a Sanic website and i run it with this command, so the port 8000 is suposed to be accessible from another host, but it doesn't work:

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=8000)

My current Dockerfile is this:

FROM mcr.microsoft.com/vscode/devcontainers/python:3.9

RUN pip3 install pytest black

EXPOSE 8000

This is my docker-compose.yml:

version: '3'
services:
  db:
    image: postgres:15.3
    restart: always
    environment:
      POSTGRES_USER: user
      POSTGRES_PASSWORD: pass
      POSTGRES_DB: db
    volumes:
      - ./postgres-data:/var/lib/postgresql/data
    ports:
      - "5432:5432"
  app_web:
    build: .
    ports:
      - "0.0.0.0:8000:8000"

And this is my devcontainer.json:

{
    "name": "Test development env",
    "dockerFile": "Dockerfile",
    "settings": {
        "files.eol": "\n",
        "python.languageServer": "Pylance",
        "python.formatting.provider": "black",
        "editor.formatOnSave": true,
        "files.exclude": {
            "**/__pycache__": true,
            "**/.pytest_cache": true,
            "**/.venv": true,
            "**/*.egg-info": true
        },
        "python.pythonPath": "/usr/local/bin/python",
        "python.testing.pytestPath": "/usr/local/bin/pytest",
        "python.testing.pytestEnabled": true,
        "python.testing.autoTestDiscoverOnSaveEnabled": true,
        "python.linting.ignorePatterns": [
            ".vscode/",
            "**/site-packages/",
            "**/__pycache__/",
            "**/.pytest_cache/",
            "**/*.egg-info"
        ],
    },
    "extensions": [
        "ms-python.vscode-pylance",
        "mhutchie.git-graph",
    ],
    "remoteUser": "vscode",
    "containerUser": "vscode",
    "runArgs": [
        "--network=bridge",
    ],
    "postCreateCommand": "pip install -U --force-reinstall -e ."
}

And this is what i get if a type "netstat -a" in Powershell:

netstat -a

Conexiones activas

  Proto  Dirección local        Dirección remota       Estado
  TCP    0.0.0.0:135            DESKTOP-KVGLPO6:0      LISTENING
  TCP    0.0.0.0:445            DESKTOP-KVGLPO6:0      LISTENING
  TCP    0.0.0.0:623            DESKTOP-KVGLPO6:0      LISTENING
  TCP    0.0.0.0:5040           DESKTOP-KVGLPO6:0      LISTENING
  TCP    0.0.0.0:5357           DESKTOP-KVGLPO6:0      LISTENING
  TCP    0.0.0.0:5432           DESKTOP-KVGLPO6:0      LISTENING
  TCP    0.0.0.0:7070           DESKTOP-KVGLPO6:0      LISTENING
  TCP    0.0.0.0:7680           DESKTOP-KVGLPO6:0      LISTENING
  TCP    0.0.0.0:16992          DESKTOP-KVGLPO6:0      LISTENING
  TCP    0.0.0.0:49664          DESKTOP-KVGLPO6:0      LISTENING
  TCP    0.0.0.0:49665          DESKTOP-KVGLPO6:0      LISTENING
  TCP    0.0.0.0:49666          DESKTOP-KVGLPO6:0      LISTENING
  TCP    0.0.0.0:49667          DESKTOP-KVGLPO6:0      LISTENING
  TCP    0.0.0.0:49668          DESKTOP-KVGLPO6:0      LISTENING
  TCP    0.0.0.0:49680          DESKTOP-KVGLPO6:0      LISTENING
  TCP    0.0.0.0:58636          DESKTOP-KVGLPO6:0      LISTENING
  TCP    10.12.0.137:139        DESKTOP-KVGLPO6:0      LISTENING
  TCP    10.12.0.137:52179      10.10.0.100:8000       ESTABLISHED
  TCP    10.12.0.137:52180      10.10.0.100:8000       ESTABLISHED
  TCP    10.12.0.137:52181      10.10.0.100:8000       ESTABLISHED
  TCP    10.12.0.137:61190      10.10.0.100:ms-wbt-server  ESTABLISHED
  TCP    127.0.0.1:6463         DESKTOP-KVGLPO6:0      LISTENING
  TCP    127.0.0.1:8000         DESKTOP-KVGLPO6:0      LISTENING
  TCP    127.0.0.1:8000         kubernetes:53541       ESTABLISHED
  TCP    127.0.0.1:8000         kubernetes:53542       ESTABLISHED
  TCP    127.0.0.1:8000         kubernetes:53545       ESTABLISHED
  TCP    127.0.0.1:8000         kubernetes:53552       ESTABLISHED
  TCP    127.0.0.1:33027        DESKTOP-KVGLPO6:0      LISTENING

As you can see, the port 8000 is only accessible from the same host, not from the outside, as it should be 0.0.0.0:8000. And of course, if i try to acceess from another host to my website, it doesn't work.

I changed the Docker for venv in python, and it works and I'm able to access from another host to my website, but i prefer to use Docker since it has more benefits than working with venv. How can i fix this problem so I can access to my website from an external host and keep using Docker?

Thanks in advance!

Answer 1

published ports are insecure by default, I suggest you try to expose ports like this

app_web:
    build: .
    ports:
      - "8000:8000"

see https://docs.docker.com/network/#published-ports