Dockerfile Security: Avoid Exposing Ports Outside Allowed Range

Out-of-range EXPOSE ports are invalid and can break runtime expectations. Use ports between 0 and 65535 and document service ports explicitly.

Problem

EXPOSE values outside 0-65535 are invalid and create misleading runtime metadata. Even if a build passes, platform tooling and operators get a broken network contract. Action: validate every declared port in CI and reject out-of-range values.

Description

EXPOSE is metadata, but many tools consume it to generate manifests, service templates, and deployment defaults. When metadata is wrong, automation distributes the error quickly. Action: keep EXPOSE aligned with real listeners and remove stale ports in the same pull request.

Invalid port declarations also slow incident response. During outages, responders use image metadata to map expected traffic paths. Wrong declarations force manual container inspection under pressure. Action: add a release check that compares declared ports to actual listening ports in runtime tests.

From a security perspective, declared ports define expected attack surface and review scope. Invalid values create noise and hide real drift between image and deployment configuration. Action: include port contract validation in architecture and threat-model reviews.

Use this rollout checklist to enforce the rule:

  • Add a linter rule that allows only 0-65535 in EXPOSE.
  • Keep Dockerfile and deployment manifest port changes in one commit.
  • Fail CI if declared ports do not match process listeners in tests.
  • Remove deprecated ports instead of leaving historical metadata in place.

Treat verification as part of the rule, not optional cleanup. Action: automate a static check, a build check, and a runtime smoke check in the default CI pipeline so regressions are caught before review.

  • Static check: fail when the disallowed pattern appears in Dockerfile or manifest.
  • Build check: run a minimal image build to confirm the secure pattern is valid.
  • Runtime check: start the workload and assert expected behavior with one deterministic probe.

Examples of code

Problematic code

FROM ubuntu:24.04
EXPOSE 70000
CMD ["python3", "-m", "http.server", "8080"]

Verified code

FROM ubuntu:24.04
EXPOSE 8080/tcp
CMD ["python3", "-m", "http.server", "8080"]

Related rules