Why you cannot reach a container yet

Back in the running-containers topic you started nginx in the background. It was running - but if you tried to open it from the host, nothing answered. That is not a bug. It is isolation doing its job.

A container has its own network

Just as a container has its own filesystem and process list, it has its own network. When nginx listens on port 80, it listens on port 80 inside the container, on the container's private network. That port is not automatically visible on the host machine.

So the service is up and reachable from inside its own network, but the host - and anything outside - has no path to it. The container is sealed by default, which is a sensible security stance: nothing is exposed unless you say so.

The fix is to publish a port

To reach a container's service from the host, you tell Docker to publish the container's port onto a port on the host. Docker then forwards traffic that arrives at the host port into the container.

You set this up when you run the container, with the -p flag, which the next node covers. The mental model to hold now:

• Inside the container: the service listens on its own port.
• Publishing: Docker opens a host port and forwards it inward.
• From the host: you connect to the host port and reach the service.

Without publishing, a container's ports stay private. This is the single most common reason a beginner's "the server is running but I cannot connect" question has such a simple answer.