Can Docker publish another port on a running container?

An existing container's published-port configuration cannot be extended through the ordinary docker update interface. Recreate the container with the new mapping, or introduce a separate proxy that provides another endpoint. A proxy does not change the container's recorded port bindings.

docker port is a query

docker container port myapp 8080/tcp

This asks which host endpoint publishes the container's TCP port 8080. It does not add a mapping. If the specified port is not published, Docker may report that no public port exists; do not assume an empty result means the application itself is not listening.

Make the change in the deployment definition

For Compose, add the desired entry under ports, then run docker compose up -d SERVICE. Compose replaces the service container as needed. A simple restart does not recreate its network configuration.

For a manually managed container, inspect and preserve the complete runtime configuration, stop and retain the old container, and create the replacement with both the old and new mappings. See the recreation workflow.

Volumes help retain data, but recreation is not inherently lossless. Save writable-layer changes, confirm the same storage is mounted, plan application consistency, and test before removing the retained container. docker commit does not back up mounted volume contents or every runtime setting.

When a forwarding layer is useful

A TCP relay or reverse proxy can bind a new host endpoint and connect to the existing service. It needs a route to the correct container address or network alias, a real application listener, and an explicit access policy.

Avoid copying a generic DNAT command into a production host. Forwarding may also depend on routing, filtering, return-path behavior, host-originated traffic, and Docker's firewall backend. A rule matching incoming packets alone is not a complete cross-platform publishing setup. Docker Desktop and rootless networking have different paths from a native Linux bridge.

An ad hoc socat relay also needs process supervision and cleanup. Its lifetime depends on how it was launched; neither persistence nor automatic disappearance is a reliable configuration strategy. A managed proxy on a user-defined network can use stable service naming instead of embedding a transient container IP.

Keep the concepts separate

EXPOSE and expose are not firewall rules. Peers on the same network can normally reach listening ports without those declarations.

FAQ

Is all container networking immutable?

No. Docker supports operations such as connecting an existing container to another network. That does not imply support for updating its published-port list.

Can I edit internal Docker configuration files?

That bypasses daemon-managed state and is not a supported deployment workflow. Recreate through the API instead.

What changes in Kubernetes?

A Service can change access to an already listening Pod without recreating it. A Pod-template change in a Deployment usually triggers replacement Pods. Declaring a port does not start the listener.

After the change, test from the intended client network. Guance TCP tests can check a reachable socket; application-level HTTP or database checks establish more than TCP connectivity alone.

See port publishing and Docker port.