UDP published ports

​

What it does

• Publishes the UDP port straight on the host. UDP does not go through the HTTP reverse proxy, which cannot carry it.
• Accepts the short form ("53:53/udp") and the long form (target, published, protocol: udp).
• Treats TCP and UDP on the same number as two separate ports. 53:53/tcp and 53:53/udp can both be declared.
• Shows each published port as 53/udp (or 53/tcp). The API returns it under published_ports on the app and on each compose deploy services[] entry:

"published_ports": [{"container_port": 53, "host_port": 53, "protocol": "udp"}]

​

What it does not do

• It works on the control plane’s own node only. A service placed on a remote node is refused with published_port_remote_node.
• It gives no reachability probe. A UDP port only reports whether it is bound.
• It does not add capabilities, sysctls or host networking (see Not yet).

​

Safety

• The port binds to the service’s bind address, which is private by default, like a TCP host port. Making it public follows the same exposure rules as a TCP host port, see App ports and exposure.
• The host or cloud firewall must still allow the port from the clients you want. Publishing does not open it for you.
• A public UDP service is easy to abuse. An open DNS resolver can be used for amplification, so keep it private unless you mean to serve the internet.
• Exposure findings already list UDP ports from Docker.
• The interaction with the Docker DOCKER-USER firewall chain has not been tested on a real server yet. Do not rely on a DOCKER-USER rule to restrict a UDP port until it is.
• The host firewall view (GET /api/v1/firewall/host, see Host firewall) lists each published UDP port with its app, bind address and whether ufw allows it.
• A deploy is refused when another process on the server already binds the UDP port on a clashing address. systemd-resolved on 127.0.0.53:53 does not clash with the private default (127.0.0.1), but it does clash with a public bind. If the socket table cannot be read (not Linux), the check is skipped and Docker reports the bind failure.

​

Errors

​

Example: UDP echo test

services:
  echo:
    image: python:3.12-alpine3.20
    command:
      - python3
      - -c
      - |
        import socket
        s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        s.bind(("0.0.0.0", 9000))
        while True:
            d, a = s.recvfrom(65535)
            s.sendto(d, a)
    ports:
      - "9000:9000/udp"

levelrail-cli compose deploy echo -f compose.yaml
echo hello | nc -u -w1 <server-ip> 9000

​

Example: DNS-style service

services:
  dns:
    image: alpine:3.20
    command:
      - sh
      - -c
      - apk add --no-cache dnsmasq && exec dnsmasq -k --no-resolv --port=53 --interface=eth0 --address=/app.test/10.0.0.5
    ports:
      - target: 53
        published: 5354
        protocol: udp
      - "5354:53/tcp"

​

Not yet

• cap_add (for example NET_ADMIN)
• sysctls
• network_mode: host