<p>There are two kubelet nodes and each kubelet node contains several containers including server with wildfly. Even though I do not define containerPort &lt;&gt; hostPort, the management console can be reached with port 9990 from outside. I do not have any clue, why?</p>
<pre><code>- name: server
  image: registry/server:develop-latest
  ports:
    - name: server-https
      containerPort: 8443
      hostPort: 8443
</code></pre>
<p>In docker container inspect &lt;container-id&gt; I see:</p>
<pre><code>&quot;ExposedPorts&quot;: {
    &quot;9990/tcp&quot;: {},
     ...
</code></pre>
<p>So,</p>
<ul>
<li>Why container port 9990 is exposed? and</li>
<li>Why containerPort 9990 is mapped to hostPort and I can reach the port 9990 from outside?</li>
</ul>

<p>You can expose the port in two places, when you run the container, and when you build the image. Typically you only do the latter since exposing the port is documentation of what ports are likely listening for connections inside the container (it doesn't have any affect on networking).</p>
<p>To see if the port was exposed at build time, you can run:</p>
<pre class="lang-bash prettyprint-override"><code>docker image inspect registry/server:develop-latest
</code></pre>
<p>And if that port wasn't exposed in your build, then it was likely exposed in your base image.</p>
