feat(run): add support for `--expose` and `--publish-all` by Mujib-Ahasan · Pull Request #5036 · containerd/nerdctl

Mujib-Ahasan · 2026-07-02T18:59:23Z

Description

This PR adds support for the Docker compatible --expose and --publish-all (-P) flags to nerdctl run and nerdctl create.

Previously, nerdctl supported explicit port publishing through --publish (-p), but did not support declaring additional exposed ports with --expose or automatically publishing all exposed ports using -P. With this change, users can expose additional container ports via the CLI, and -P will publish both image defined (EXPOSE) and cli defined (--expose) ports to automatically allocated host ports by reusing the existing port mapping implementation. This improves Docker CLI compatibility while preserving the existing behaviors.

Fixes: #4689

AkihiroSuda · 2026-07-02T19:10:58Z

 	// publish is defined as StringSlice, not StringArray, to allow specifying "--publish=80:80,443:443" (compatible with Podman)
 	cmd.Flags().StringSliceP("publish", "p", nil, "Publish a container's port(s) to the host")
+	cmd.Flags().StringSlice("expose", nil, "Expose a port or a range of ports")
+	cmd.Flags().BoolP("publish-all", "P", false, "Publish all exposed ports to random ports")


Please update the docs too

nerdctl/docs/command-reference.md

Lines 457 to 460 in 4608753

Unimplemented `docker run` flags:

`--device-cgroup-rule`, `--disable-content-trust`, `--expose`,

`--health-start-interval`, `--link*`, `--publish-all`, `--storage-opt`,

`--volume-driver`

Also needs tests

@AkihiroSuda Since nerdctl doesnot implement Docker content trust, would you accept --disable-content-trust as a compatibility (no operation) similar to Podman: https://docs.podman.io/en/latest/search.html?q=--disable-content-trust.

@AkihiroSuda Since nerdctl doesnot implement Docker content trust, would you accept --disable-content-trust as a compatibility (no operation) similar to Podman: https://docs.podman.io/en/latest/search.html?q=--disable-content-trust.

Doesn't seem relevant to --expose and --publish-all. Please open a new issue.
We have to consider what it means with cosign.

AkihiroSuda · 2026-07-02T19:12:03Z

 	UTSNamespace string
 	// PortMappings specifies a list of ports to publish from the container to the host
 	PortMappings []cni.PortMapping
+	ExposedPorts []string


Needs a code comment. How does it relate to PortMappings?

AkihiroSuda · 2026-07-02T19:12:16Z

 	// PortMappings specifies a list of ports to publish from the container to the host
 	PortMappings []cni.PortMapping
+	ExposedPorts []string
+	PublishAll   bool


Needs a code comment

AkihiroSuda · 2026-07-02T19:14:24Z

image defined (EXPOSE)

Doesn't seem covered in this PR?

AkihiroSuda

Needs tests

Mujib-Ahasan · 2026-07-02T19:16:51Z

Doesn't seem covered in this PR?

will add this shortly!

AkihiroSuda · 2026-07-09T02:19:23Z

 }
+
+func TestRunExposeOnly(t *testing.T) {
+	base := testutil.NewBase(t)


NewBase is deprecated

Rewrite tests using testutil.NewBase to use nerdtest.Setup (Tigron) #4613

AkihiroSuda · 2026-07-09T19:37:37Z

Please squash the commits

AkihiroSuda · 2026-07-09T19:37:46Z

+func TestRunExposeOnly(t *testing.T) {
+	testCase := nerdtest.Setup()
+
+	testCase.Require = require.Linux


Already implied by the file name

AkihiroSuda · 2026-07-09T19:38:10Z

+
+	testCase.Require = require.All(
+		require.Linux,
+		require.Not(nerdtest.Rootless),


Please add a comment line to explain the reason

AkihiroSuda · 2026-07-09T19:54:39Z

+	testCase := nerdtest.Setup()
+
+	testCase.Require = require.All(
+		require.Not(nerdtest.Rootless), // Automatic port allocation is only supported in rootful mode.


Why not supported in rootless?

I think permission thing. rootless containrs do not have permission to bind random host ports.(not sure)

AkihiroSuda

Thanks

AkihiroSuda · 2026-07-11T01:18:51Z

=== FAIL: cmd/nerdctl/container TestRunCustomRootfs (re-run 2) (0.25s)
    container_run_linux_test.go:66: assertion failed: 
        Command:  /usr/local/bin/nerdctl --namespace=nerdctl-testruncustomrootfs run --rm --rootfs /tmp/TestRunCustomRootfs2687664319/002/rootfs1801270034 /bin/cat /proc/self/environ
        ExitCode: 2
        Error:    exit status 2
        Stdout:   
        Stderr:   panic: runtime error: invalid memory address or nil pointer dereference
        [signal SIGSEGV: segmentation violation code=0x1 addr=0x30 pc=0x10ef06f]
        
        goroutine 1 [running]:
        github.com/containerd/nerdctl/v2/pkg/cmd/container.Create({_, _}, _, {_, _, _}, {_, _}, {{0x1615100, 0x145fe6302028}, ...})
        	/go/src/github.com/containerd/nerdctl/pkg/cmd/container/create.go:297 +0x272f
        github.com/containerd/nerdctl/v2/cmd/nerdctl/container.runAction(0x145fe6543508, {0x145fe63a2190, 0x3, 0x5})
        	/go/src/github.com/containerd/nerdctl/cmd/nerdctl/container/container_run.go:404 +0x517
        github.com/spf13/cobra.(*Command).execute(0x145fe6543508, {0x145fe6344030, 0x5, 0x5})
        	/go/pkg/mod/github.com/spf13/[email protected]/command.go:1015 +0xb14
        github.com/spf13/cobra.(*Command).ExecuteC(0x145fe6542f08)
        	/go/pkg/mod/github.com/spf13/[email protected]/command.go:1148 +0x465
        github.com/spf13/cobra.(*Command).Execute(...)
        	/go/pkg/mod/github.com/spf13/[email protected]/command.go:1071
        main.xmain()
        	/go/src/github.com/containerd/nerdctl/cmd/nerdctl/main.go:150 +0x8f
        main.main()
        	/go/src/github.com/containerd/nerdctl/cmd/nerdctl/main.go:133 +0x13

Signed-off-by: Mujib Ahasan <[email protected]> test case added Signed-off-by: Mujib Ahasan <[email protected]>

AkihiroSuda reviewed Jul 2, 2026

View reviewed changes

AkihiroSuda requested changes Jul 2, 2026

View reviewed changes

Mujib-Ahasan force-pushed the expose-publish-all-flag branch 2 times, most recently from 2212a8e to e38f368 Compare July 6, 2026 19:22

AkihiroSuda reviewed Jul 9, 2026

View reviewed changes

Mujib-Ahasan force-pushed the expose-publish-all-flag branch from e38f368 to 6c2a114 Compare July 9, 2026 19:16

AkihiroSuda reviewed Jul 9, 2026

View reviewed changes

Mujib-Ahasan force-pushed the expose-publish-all-flag branch from 6c2a114 to c22c087 Compare July 9, 2026 19:51

AkihiroSuda reviewed Jul 9, 2026

View reviewed changes

AkihiroSuda approved these changes Jul 9, 2026

View reviewed changes

AkihiroSuda added this to the v2.4.0 milestone Jul 9, 2026

feat(run): add support for --expose and --publish-all

b46f2b4

Signed-off-by: Mujib Ahasan <[email protected]> test case added Signed-off-by: Mujib Ahasan <[email protected]>

Mujib-Ahasan force-pushed the expose-publish-all-flag branch from c22c087 to b46f2b4 Compare July 11, 2026 15:14

	Unimplemented `docker run` flags:
	`--device-cgroup-rule`, `--disable-content-trust`, `--expose`,
	`--health-start-interval`, `--link*`, `--publish-all`, `--storage-opt`,
	`--volume-driver`

Uh oh!

Conversation

Mujib-Ahasan commented Jul 2, 2026

Description

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AkihiroSuda Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AkihiroSuda commented Jul 2, 2026

Uh oh!

AkihiroSuda left a comment

Choose a reason for hiding this comment

Uh oh!

Mujib-Ahasan commented Jul 2, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AkihiroSuda left a comment

Choose a reason for hiding this comment

Uh oh!

AkihiroSuda commented Jul 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

AkihiroSuda Jul 2, 2026 •

edited

Loading