networking - How can I expose a Docker container port only to localhost so that it is also accessible via an ssh tunnel? -

hopefully straightforward. know how bind host

-p 127.0.0.1:$hostport:$containerport 

the issue i'm encountering doing preventing me accessing mapped host port on ssh tunnel docker host.

is there way without having block port upstream docker host somewhere?

just make target of ssh tunnel localhost or 127.0.0.1.

ssh -l local-port:127.0.0.1:container-port docker-host 

would forward local-port localhost:container-port on docker-host. no need expose container port external network.