Tracking Port Usage
reddit / selfhosted

----------------------------------------------------------------------
apperrault · 2023-11-22 01:39

hey all, maybe my Google-Fu is glitching tonight, but what, if
anything, do y'all use to track port usage in your docker containers?
I know I can browse through Portainer, or grep some data out of my
docker compose files etc, but I am hosting things on 3 different
machines through a single reverse proxy, and I am just looking for an
easy way to trace what ports are in use.

Ideally this would be some sort of container that can gather this
data, but looking for recommendations

thanks

app

----------------------------------------------------------------------
NikStalwart · 2023-11-22 02:54

I'm not sure if google-fu is glitching as much as imagination. You
have three clean options:

 * # docker container ls (shows container name and ports)
 * # netstat -ban (shows *all* ports in use on the system + the binary
running the service)
 * Just write documentation for yourself when you bring up a new
service. Doesn't have to be anything fancy, a simple markdown or YAML
file can be used. I use YAML in case I ever want to use it
programmatically.


netstat -an is your friend.

Documentation is your second best friend.

----------------------------------------------------------------------
ProbablePenguin · 2023-11-23 15:35

I'm a little confused why this would be needed, I only need the port
during initial setup of a stack, once it's running everything goes
through the proxy and I never need the port again.

----------------------------------------------------------------------
apperrault · 2023-11-23 15:39

I need it when I add new containers. I need to know what ports are not
in use.

----------------------------------------------------------------------
ProbablePenguin · 2023-11-23 16:50

Ah, portainer gives me an error if one is, so I just mash the numpad
and choose another.

----------------------------------------------------------------------
sk1nT7 · 2023-11-23 17:00

Use a reverse proxy only and leave the network port in its docker
network alone. Use the expose key in docker compose to document which
ports are exposed by the container. Do not just map container ports to
the host. TCP 443 and 80 for the reverse proxy is most often
sufficient as only port mappings.

Also, any active firewall should be a good documentation too. Drop all
and whitelist specific ports and services only.

----------------------------------------------------------------------
apperrault · 2023-11-23 17:18

I only have 443 exposed. The other ports are for internal use.

----------------------------------------------------------------------
sk1nT7 · 2023-11-23 17:43

I know, but even exposing the ports internally is unnecessary as you
do not have to map the container ports to your host. Let the reverse
proxy handle it.

Put reverse proxy and the to be proxied service into the same docker
network and they can freely communicate with each other. You, as
client, only talk to the reverse proxy on TCP 443. Rest occurs
intransparently within the docker networks itself.

----------------------------------------------------------------------
apperrault · 2023-11-23 20:23

Apparently, I just needed to wait.  :-)  I happened to be looking at
something else today and found this project [https://github.com/Notifi
arr/dockwatch](https://github.com/Notifiarr/dockwatch)

If you look at one of the panels, it shows ports being used!!