Container Ports on Synology NAS Conflicts and Safe Choices
A container can be running perfectly and still be invisible — because nothing connected its inside port to the outside world, or because two services tried to own the same door. Ports are simple once the two halves are separated, and dangerous mainly when people open them to the internet without thinking. This guide covers both.
🎥 Watch the complete installation in the video — Docker on a Synology NAS, step by step
Every app in a container listens on a port — a numbered door. The app chooses its own door inside the container; that number is fixed by the app and printed in its documentation. Your decision is the host port: the door on the NAS itself that forwards to it. When you open http://nas-address:8080 in a browser, 8080 is the host port, and Container Manager passes you through to whatever port the app uses inside — often 80 or the app's own number. Two doors, one corridor. Almost every port problem is these two being confused, or two corridors being assigned the same outside door.
Reading a port mapping — 8080 outside, 80 inside
Browser → 192.168.1.50 : 8080 (host port — your choice)
|
Container Manager forwards
|
Container → app listening on : 80 (container port — app decides)
DSM's own web interface5000 / 5001 — TAKEN
Standard web ports 80 / 443 on the NASOFTEN TAKEN
One mapping, two numbers. Change the left number freely; the right number belongs to the app and is not yours to invent.
1
Host Port Versus Container Port — The Whole Idea
In Container Manager's container creation screens you will see port settings with a local side and a container side.
Container port: fixed by the app. If the app's page says it serves on 9000, that side stays 9000.
Local (host) port: your choice. It must be unique on the NAS — one door, one app.
They may match (9000 to 9000) when the door is free, or differ (8080 to 80) when it is not. The app neither knows nor cares.
Write every pairing down. Three months later, which app was on 8081 is a question nobody enjoys answering from memory.
2
The Doors Already Taken on a Synology
The classic first failure: a new container will not start, and its log complains the address is already in use. The NAS was there first.
5000 and 5001 — DSM's own web interface, HTTP and HTTPS. Never assign these to a container.
80 and 443 — frequently claimed by DSM's web services and reverse proxy features. Many guides written for other machines say map straight to 80; on a Synology that door is usually occupied or reserved.
Ports of any DSM service you run — file services, media packages, surveillance — each holds its own door. When a container refuses to start, check its log for the port complaint before changing anything else.
The painless habit: give containers host ports in the 8000 to 9000 range and keep a list.
3
Checking a Container Is Really Listening
Before blaming the network, prove the simple things in order.
The container shows running in Container Manager, not restarting.
Its Log shows the app's ready line with the port it listens on.
From a computer on the same home network, open http://nas-ip:host-port. Use the NAS's IP address, not a remote access name, for this first test.
Page opens: the corridor works, and any remaining trouble is in the app itself. Page refuses: recheck the pairing — the most common slip is editing the container side instead of the host side.
4
The Safety Line — Home Network Yes, Internet Careful
A published port on your home network is ordinary. A published port on the internet is a door in your house wall, and containers deserve the same suspicion as any other door.
Publishing a port in Container Manager makes the app reachable on your local network. It does not by itself expose anything to the internet — that happens only if you also forward the port on your router.
Think twice before forwarding to admin dashboards, container managers like Portainer, or any app without its own strong login. These are the doors attackers knock on first.
The safer patterns: reach admin tools through a VPN into your home, or put real web apps behind DSM's reverse proxy with HTTPS and let ordinary containers stay unpublished to the outside.
And keep the DSM firewall enabled, allowing only the services you actually use.
5
When Two Apps Honestly Need the Same Door
Two web apps both wanting host port 80 is normal life. The container-side numbers stay as they are; only the host side separates — 8080 for one, 8081 for the other, and your bookmarks carry the number. If you want tidy addresses without port numbers, that is precisely the job of DSM's reverse proxy, which listens on the standard HTTPS door and routes by name to each container behind it. That is a project for a quiet afternoon, not a requirement for a working setup.
🔴 Port rule in one line: the container's port belongs to the app, the host port belongs to you, two apps can never share one host port — and a port you forward on your router is a door to the whole internet, so choose those like it matters. It does.
🎥 Watch the Complete Video
The full Docker on Synology NAS installation, shown live on a real NAS from package install to a running container.
My container will not start and the log says the address is already in use. What does that mean?
Another service on the NAS already owns the host port you chose — very commonly DSM itself on 5000 or 5001, or a previous container. Change the host side of the mapping to a free number, such as something in the 8000s, and leave the container side exactly as the app expects.
Does publishing a port expose my NAS to the internet?
No, not by itself. Publishing a port in Container Manager makes the app reachable from devices on your own home network. It becomes reachable from the internet only if you also forward that port in your router, which is a separate, deliberate step that deserves care — especially for admin tools and dashboards.
Can two containers use the same port number?
They can use the same container-side port, because each container lives in its own private space. They cannot share the same host port on the NAS — one door can only lead to one app. Give the second container a different host port, such as 8081 instead of 8080.
This guide is based on the Technical Anshu video on installing Docker on a Synology NAS • Stuck on a step? Ask in the video comments 🙏