The Isolated Wall

Look, if you've ever dealt with this in production, you know exactly what the problem is. You successfully ran an Nginx web server using docker run nginx. Nginx defaults to serving websites on Port 80. So, you open Chrome and go to http://localhost:80. Nothing happens. The browser says 'Connection Refused'. Why? Because a container is an isolated prison. By default, its internal network is completely blocked from the outside world. To reach the Nginx server inside the container, you must punch a hole through that wall. This isn't just academic theory—understanding the *why* behind this is what separates junior devs from senior engineers. When you deploy to a cluster, this is the mechanic that prevents catastrophic failure.

Look, if you've ever dealt with this in production, you know exactly what the problem is. To punch that hole, we use 'Port Mapping' with the -p flag. The syntax is strictly -p HOST_PORT:CONTAINER_PORT. If you run docker run -p 8080:80 nginx, you are telling the Docker Daemon: 'Take Port 8080 on my laptop, and wire it directly to Port 80 inside the container.' Now, when you visit localhost:8080 in Chrome, Docker intercepts the traffic and forwards it into the container. This isn't just academic theory—understanding the *why* behind this is what separates junior devs from senior engineers. When you deploy to a cluster, this is the mechanic that prevents catastrophic failure.

Look, if you've ever dealt with this in production, you know exactly what the problem is. Images are immutable blueprints. But what if you need to pass dynamic configuration into that blueprint when it starts? For example, setting a database password. You cannot edit the code, but you can inject Environment Variables at runtime using the -e flag. If you run the official Postgres image without setting a password via an environment variable, the container will instantly crash for security reasons. This isn't just academic theory—understanding the *why* behind this is what separates junior devs from senior engineers. When you deploy to a cluster, this is the mechanic that prevents catastrophic failure.

The Isolated Wall. You successfully ran an Nginx web server using docker run nginx. Nginx defaults to serving websites on Port 80. So, you open Chrome and go to http://localhost:80. Nothing happens. The browser says 'Connection Refused'. Why? Because a container is an isolated prison. By default, its internal network is completely blocked from the outside world. To reach the Nginx server inside the container, you must punch a hole through that wall.

Port Mapping. To punch that hole, we use 'Port Mapping' with the -p flag. The syntax is strictly -p HOST_PORT:CONTAINER_PORT. If you run docker run -p 8080:80 nginx, you are telling the Docker Daemon: 'Take Port 8080 on my laptop, and wire it directly to Port 80 inside the container.' Now, when you visit localhost:8080 in Chrome, Docker intercepts the traffic and forwards it into the container.

You want to run a PostgreSQL database container. The database internally listens on port 5432. You want your laptop to connect to it using port 9000. Which port mapping flag is correct?

• →-p 5432:9000
• →-p 9000:5432

Environment Variables. Images are immutable blueprints. But what if you need to pass dynamic configuration into that blueprint when it starts? For example, setting a database password. You cannot edit the code, but you can inject Environment Variables at runtime using the -e flag. If you run the official Postgres image without setting a password via an environment variable, the container will instantly crash for security reasons.

Combining Flags. In the real world, you rarely use just one flag. When you spin up a container, you typically need to detach it so it runs in the background (-d), map its ports so you can access it (-p), and inject secrets (-e). You can stack all of these flags together in a single powerful docker run command.

If you want to run a Redis database in the background, map the host port 6379 to the container port 6379, and set an environment variable REDIS_PASS=123, which command is correct?

• →docker run -d -p 6379:6379 -e REDIS_PASS=123 redis
• →docker run redis -d -p 6379 -e 123

Runtime Execution Mastered. You have now mastered the art of executing and configuring containers at runtime. You can breach the container's isolation using port mapping and safely inject dynamic configuration using environment variables. However, all we have done so far is run *other* people's code from Docker Hub. In the next module, you will learn to build your own custom Images.