Why did I have access to Container-Optimized OS-based GCE when I didn't do docker container port mapping?

Question

I want to deploy my spring-boot application on the Google Compute Engine(GCE) of the Google Cloud Platform(GCP). I understand that when distributing containers to the host machine, I have to map the port in the container to the port in the host machine through the following command.

docker run -it -p 8080:8080 spring-app

However, when I didn't do docker container port mapping, why did I have access to Container-Optimized OS-based GCE?

Here's my Dockerfile in the spring-boot application. (iampotato is my project name.):

FROM adoptopenjdk/openjdk11:latest AS TEMP_BUILD_IMAGE
ENV APP_HOME=/usr/app/
WORKDIR $APP_HOME
COPY build.gradle settings.gradle gradlew $APP_HOME/
COPY gradle $APP_HOME/gradle/
RUN ./gradlew -x test --info || return 0
COPY . .
RUN ./gradlew -x test build

FROM adoptopenjdk/openjdk11:latest
ENV ARTIFACT_NAME=iampotato.jar
ENV APP_HOME=/usr/app/

WORKDIR $APP_HOME
COPY --from=TEMP_BUILD_IMAGE $APP_HOME/build/libs/$ARTIFACT_NAME .

EXPOSE 8080
ENTRYPOINT java -Dspring.profiles.active=dev -jar $ARTIFACT_NAME

Here's the desired result:

• I think I should not be able to access the spring-boot application because I didn't do container port mapping.

This Setting port mapping in docker on Container-Optimized OS is related, but it doesn't answer my question of why I don't need to do port mapping on Container-Optimized OS-based GCE.

Here's my environment:

• Spring Boot 2.7.9
• OpenJDK 11
• Container-Optimized OS-based GCE
• Docker 20.10.12

Answer 1

Container ports have a one-to-one mapping to the host VM ports. For example, a container port 80 maps to the host VM port 80. Compute Engine does not support the port publishing (-p) flag, and you do not have to specify it for the mapping to work.

Publishing container ports

Note: This applies to Container Optimized OS and not Docker running on a regular Compute Engine.