Expose VM & container port only on host loopback/127.0.0.1

[zcutlip]

I'm running Colima on macOS. I have a docker container I'm running with -p "127.0.0.1:25:25". But on my host I see the vm listening on *:25 rather than 127.0.0.1:25.

I tried setting hostAddresses: true in the Colima config. The description sounds like what this option is for, but it didn't change anything.

Am I missing something?

[abiosoft]

Can you share the output of docker ps?

[zcutlip]

sure, here you go:

CONTAINER ID   IMAGE                      COMMAND     CREATED        STATUS        PORTS                  NAMES
cfea06890457   juanluisbaptiste/postfix   "/run.sh"   21 hours ago   Up 21 hours   127.0.0.1:25->25/tcp   postfix

[zcutlip]

here's lsof showing limactl listing on all interfaces on port 25:

❱ sudo lsof -iTCP:25 -sTCP:LISTEN -n -P
Password:
COMMAND   PID       USER   FD   TYPE            DEVICE SIZE/OFF NODE NAME
limactl 47925 zach-admin   13u  IPv6 0x1edbc24e55a8116      0t0  TCP *:25 (LISTEN)

And here's an nmap scan of that host showing port 25 open externally:

❱ nmap -n -p25 exegol
Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-27 09:05 PST
Nmap scan report for exegol (10.0.1.4)
Host is up (0.010s latency).

PORT   STATE SERVICE
25/tcp open  smtp

Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds

[zcutlip]

Hi, I just wondered if there's any advice here? Is this a known issue or a configuration mistake on my end?

I have containers that I need to not be exposed to the local network and only available on the host. I suspect others have similar needs.

Thanks!