How to read docker port mapping information? - mysql

Question

I just started learning docker and I‘m a bit confused with port mapping in docker. I have container (which runs mysql service) running as below:
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS
59efytd163d3 myapp:mysql "docker-entrypoint.s…" 10 months ago Up 5 minutes 0.0.0.0:9991->3306/tcp
For the PORTS field, what does 0.0.0.0:9991->3306/tcp mean?
I checked the port number of mysql that's running outside the container:
john#MacBook-Pro:~/Documents$ lsof -n -P -i TCP | grep mysql
mysqld 1742 john 58u IPv4 0xd3c7de51ef6d2a49 0t0 TCP 127.0.0.1:3306 (LISTEN)
As you can see, the port is 3306, so I thought the port number for the mysql running inside the container must be 9991. However, after I got into the container and checked the mysql:
mysql> SHOW GLOBAL VARIABLES LIKE 'PORT'
-> ;
+---------------+-------+
| Variable_name | Value |
+---------------+-------+
| port | 3306 |
+---------------+-------+
1 row in set (0.00 sec)
It also shows 3306.
Both the mysql services running inside and outside the container has port number 3306. Where does the 0.0.0.0:9991->3306/tcp mean then? what does the 0.0.0.0:9991 refer to?

Answer 1

Docker runs containers on virtual networks:
docker network ls
NETWORK ID NAME DRIVER SCOPE
1234567890ab bridge bridge local
cdef01234567 deployment_default bridge local
890abcdef012 host host local
34567890abcd none null local
These port mappings bind ports on your host machine with containers running on these networks.
Think of each container as its own localhost with all ports available to it. In this case, your MySQL instance exposes port 3306 on its container. This is necessary because the binary in the container is also running on 3306. This explains why, within the container, you see 3306.
Very conveniently, when you run a container, Docker provides a mechanism for you to remap container ports (e.g. 3306) onto different ports (e.g. 9991) on your host machine.
This is more than just a convenience. If you wanted to run a second MySQL container image and it was also configured for 3306, you'd be unable to access both containers at the same time because they'd collide with the port 3306 on your host.
So, you define a port-mapping as you've done. In your example, from your local workstation (host), you can access the MySQL container instance on localhost:9991 and Docker remaps that port's traffic to the MySQL container's port 3306 and the container routes it to the MySQL binary (also on 3306).
So: 0.0.0.0:9991->3306/tcp means:
0.0.0.0 (an alias for any adaptor on localhost)
9991 port traffic maps to this container's port 3306
Using TCP (another protocol that you will see is UDP)
Three additional notes:
This image's Dockerfile may include e.g. EXPOSE 3306. This is purely documentary and in no way affects the docker run ... --publish=XXXX/3306.. command.
Container needs not publish ports to the localhost. This need only be done if the container image must be accessed from the host. If you name your containers and put them on user-defined networks or use Docker Compose, one container may access ports on another container without exposing ports to the host. Exposing ports like this should be (!) a security consideration.
When you run a container image, Docker uses a default network. The port-mapping resolution (0.0.0.0:XXXX/YYYY) is actually a combination of identifying which container (hostname resolution) and which port.