Docker Expose ports dynamically

Question

Is it possible to expose docker ports dynamically, once a container is launched?

If not, what is the best practice to achieve something like this?

The use-case would be like: I need to expose Java JMX Port momentarily to configure some application, and then close those ports (from the container), without actually closing the JMX Service, or modifying the Java application.

Thanks

Answer 1

With Weave network for Docker any port your application might open would be accessible from inside the network with no external intervention, unlike the aforementioned ambassador patter. However, those would be only accessible from the subnet the application is on. You the ports you statically expose will remain NATed by Docker too and would be externally accessible, but ephemeral once would be internal-only.

Answer 2

Never found a way to open ports dynamically.

Would it help to open a static port and start/stop a tunnel inside the container that forwards to the JMX Port. socat or ssh comes to mind, e.g.

ssh -L<static-sourceport>:<targetserver>:<jmx-targetport> localhost