Docker / Networking, Ports & Service Connectivity
Investigate an application listening only on loopback inside its container
Publishing a port cannot generally reach a process bound only to the container's loopback address. Inspect the real listener when approved tools exist.
Environment and inputs: Docker Engine · Compose v2 and Buildx where specified; Linux containers unless noted. Verify daemon context, installed feature support and authorized host or Swarm manager access first.
Start with this check
Confirm the environment and replace sample objects, namespaces, images, paths and hosts with approved targets. Share only relevant, sanitized output. Follow the workload owner’s process for changes.
docker container exec app ss -lntRead the result
This starts a read-only socket-listing process in a running Linux container that includes ss. Minimal images need an approved alternative and exec access is privileged.
Resolve and verify
Compare the actual listener with the intended container interface and published target port. Correct application binding in the managed configuration and redeploy through the normal workflow.
Before changing production
Do not install debugging packages into a live production image or expose every application interface without reviewing access policy.