By default, all container processes are isolated from outside access. This means that although we had defined a port for the process service (using EXPOSE on images), it will not be accessible unless we declare it publicly available. This is a great security measure. No external communication will be allowed until it is specifically declared. Only containers attached to the same bridged network or host, using its host internal IP (attached to the bridge), will be able to use the process service.
Let's review a quick example using the nginx:alpine base image. We know that nginx:alpine exposes port 80:
$ docker container run -d --name webserver nginx:alpine
4a37b49721b4fe6ffc57aee07c3fb42e5c08d4bcc0932e07eb7ce75fe696442d
$ docker container inspect webserver --format "{{json .NetworkSettings.Networks.bridge.IPAddress }}"
"172.17.0.4"
$ curl http://172.17.0.4
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>...