Am I correct in understanding that this should resolve #41822?

yes @nightah this PR should solve your issue

PTAL @tiborvass @thaJeztah

The solution of this issue has created a problem - at least on my -side: creating a container with option -P or -p 80 assigns both, IPv4 and IPv6 ports of the host to the container. Previously (version 20.10.1) it only assigned an IPv4 address.

On occasions it assigns these automatic ports to different port numbers on IPv4 and IPv6 - see https://forums.docker.com/t/why-different-port-number-is-mapped-on-ipv4-and-ipv6-address-for-same-expose-port/109795

This is a problem - at least when using the classic swarm - which seems to think that the IPv6 port is an IPv4 port. When the ports are not in sync it occurs, that, when several container with this issue are created, the IPV4 ports overlap on the swarm endpoint.

Long story short: before 20.10.2 there was no automatic IPv6 assignment using -P or -p 80. Now there is. Is that intended behavior? If so: how can it be disabled without loosing IPv6 inside the container?

Older releases implicitly bound ports on both IPv4 and IPv6. 20.10 includes that information in the API.

This is a problem - at least when using the classic swarm - which seems to think that the IPv6 port is an IPv4 port.

That's unlikely to be fixed, with classic swarm being deprecated.

for the IPv4 and IPv6 ports not being the same when using random / ephemeral port assignment, there's this ticket; #42442 (feel free to participate in the discussion there; contributions welcome as well of course 😅)

Not sure if it helps as a workaround, but if you know which ports should be mapped, you can use 0.0.0.0 as the host IP address, and have an ephemeral/random port assigned (leave out the <host-port> in the <ip-address>:<host-port>:<container-port> format). This should make the port only published on IPv4;

docker run -d -p 0.0.0.0::80 --name foobar nginx:alpine

docker port foobar 80
0.0.0.0:49155

Thanks for the elaborate explanation! I did not know about the -p 0.0.0.0::80 syntax even though I'm using docker since its beginning 🤣 - it might help me indeed.

I'll also check the mentioned issue!

Yeah, the -p shorthand syntax is unfortunately quite complex. The -P / --publish-all option can be "convenient", but in general, I recommend being explicit about which container ports must be published. The -P option automatically creates a port-mapping based on metadata of the container (EXPOSE). The EXPOSE metadata is just metadata, and does not guarantee that something is actually listening on those ports (e.g., the nginx image has both 443 and 80 as expose, but by default only listens on port 80.

Being explicit is more work, but makes sure that you know what ports will be published, and keeps you in control whether or not a port should be published. Publishing a port makes it publicly accessible and in many situations (e.g. mysql port 3306) that may not be desirable.