How to Deploy a Containerized Print Service Using IPP and Port 9100

Q: Why can’t clients reach IPP/631 or RAW/JetDirect 9100 from my Docker container?

The ports may not be published in Compose, a host firewall is blocking them, or a reverse proxy is interfering. Publish 631/9100 directly, allow only LAN/VPN subnets, and avoid proxying 9100.

Q: Is host networking required for AirPrint/Bonjour?

No, but it is the simplest. With bridge networking you need an avahi sidecar (DBus + --net=host) or advertise from the host OS so iOS/macOS discover _ipp._tcp/_ipps._tcp.

Q: Can I use Traefik/Nginx to proxy printing?

Proxy the CUPS web UI only. Printing should go directly to IPP/631 (or IPPS) and RAW 9100 on the LAN.

Q: What’s a minimal docker-compose for CUPS?

Use volumes for /etc/cups and /var/spool/cups, publish 631 (and 9100 if needed), add restart: unless-stopped and a healthcheck. Restrict with firewall and cupsd.conf Require ip @LOCAL.

Updated: October 17, 2025 · Answered by Joe B. in 3 mins

Joe B.

Reviewed for technical accuracy

Specialities: Windows 11/10, macOS (Sonoma/Ventura/Monterey), Printers, Networking, Docker, CUPS

Docker Compose CUPS print server — IPP/IPP Everywhere/AirPrint on 631 and RAW/JetDirect 9100, bridge vs host network

Technician

Hey! Let’s design a containerized print service that exposes IPP (tcp/631) and, if needed, RAW/JetDirect 9100 from your host safely. I’ll help you pick the right Docker network mode (bridge, host , or macvlan ), configure CUPS /


     cupsd.conf

, and publish ports in docker-compose with firewall rules so Windows, macOS (AirPrint / IPP Everywhere), and Linux clients can print reliably.

Customer

I’m running CUPS in Docker with Compose. Clients can’t reach it: IPP on 631 sometimes works, but RAW 9100 jobs fail. What’s the safe way to expose the host ports?

Technician

Common causes when IPP/RAW 9100 from Docker is not reachable:
• Using default bridge without proper


     ports:

mappings or publishing only 631 but not 9100.
• Host firewall (

ufw


     firewalld


     iptables

, Windows Defender Firewall) blocking inbound 631/9100.
• Running behind a reverse proxy (Nginx/Traefik). Proxies are fine for HTTP/IPP but not for RAW 9100 (binary stream) — don’t proxy 9100.
• Avahi/Bonjour (mDNS) not advertising from inside the container, so AirPrint/IPP Everywhere discovery fails.
We’ll choose the right network mode, publish the ports, and add an allow‑list so the service is reachable only on your LAN/VPN.

Customer

Bridge or host network? I also heard about macvlan.

Technician

Pick a network mode:
1) bridge (default) — safest start. Expose with Compose:


     ports: ["631:631", "9100:9100"]

. Works for IPP and JetDirect; add firewall rules on the host. For AirPrint discovery, run


     avahi-daemon

on the host or use


     --network host

.
2) host — the container shares the host stack; mDNS works out‑of‑the‑box and latency is lowest. Restrict access using the OS firewall (allow RFC1918 subnets only).
3) macvlan — gives the container its own LAN IP. Good for segmented networks or when you can’t use host mode. Requires switch/router support for the subnet; be mindful of ARP/NDP rules.
If you must deliver AirPrint over mDNS, choose host or run a small


     avahi

sidecar container with DBus and the right capabilities.

Customer

What should my


     docker-compose.yml

look like?

Technician

Compose essentials (v2):
•


     ports:

publish 631 and (optionally) 9100 from the container to the host.
• Add


     restart: unless-stopped


     healthcheck

(probe


     http://localhost:631

), and persistent


     volumes

for


     /etc/cups

and


     /var/spool/cups

.
• Drop unneeded caps (


     cap_drop: [ALL]

), run as non‑root (


     user: "1000:1000"

), and prefer a read‑only root filesystem with explicit


     tmpfs

mounts for security.
• For RAW 9100 forwarding to a physical printer, you can use CUPS backend or a lightweight


     socat

sidecar if you need pure JetDirect pass‑through.

Customer

How do I keep it private? I don’t want 631/9100 open to the internet.

Technician

Security best practices :
• Bind to LAN only:


     ports: ["192.168.1.10:631:631", "192.168.1.10:9100:9100"]

or use


     --publish

with a specific host IP.
• Allow‑list with the OS firewall (


     ufw allow from 192.168.0.0/16 to any port 631

; same for 9100). Block WAN at the router.
• Prefer IPP/IPPS over 631 with TLS if clients support it; avoid exposing 9100 beyond the LAN.
• In


     cupsd.conf

set


     Listen 0.0.0.0:631

and


     Require ip @LOCAL

; disable remote admin if not needed.
• Consider VPN (WireGuard/ZeroTier) for remote sites instead of public exposure. Never reverse‑proxy JetDirect 9100.

Customer

Windows clients use the IPP Class Driver and some use HP JetDirect on 9100. Any client tips?

Technician

Client configuration :
• Windows 10/11 : Add a printer → IPP with


     http://server:631/printers/queue


     ipp://server/printers/queue

. For RAW, use a Standard TCP/IP Port with HP JetDirect – Socket on 9100 and the correct vendor driver.
• macOS : Add via IP tab → IPP or AirPrint . Bonjour discovery needs mDNS from host/avahi. For legacy devices, LPD works too (


     lpd://

).
• Linux :


     lpadmin


     system-config-printer

to point at


     ipp://

. Test with


     lpstat -t

and


     lp -d queue test.pdf

Customer

How do I test connectivity to 631 and 9100 from the LAN?

Technician

Connectivity checks :
•


     curl -v http://server:631

should return the CUPS web UI (or a redirect to


     /admin

).
•


     nc -vz server 9100

(or


     Test-NetConnection -Port 9100

on Windows) confirms JetDirect reachability.
• If 631 works but printing fails, check


     AccessLog


     ErrorLog


     /var/log/cups

, and confirm the container healthcheck is passing.

Customer

AirPrint discovery doesn’t show the container. Can I advertise it?

Technician

Bonjour/mDNS : With bridge networking, mDNS multicast won’t escape the container. Options:
• Run the print service in host mode so


     avahi-daemon

on the host advertises the queue.
• Or add an avahi sidecar container with DBus and


     --net=host

to publish


     _ipp._tcp

and


     _ipps._tcp

(AirPrint).
• As a fallback, add printers by URL (direct


     ipp://

) on clients; discovery is optional.

Customer

We also run Traefik for other services. Should I put CUPS behind it?

Technician

You can proxy the CUPS web UI for admin over HTTPS, but don’t proxy RAW 9100 . If you expose the web UI externally, require authentication, restrict by IP, and prefer a VPN. Printing itself should go directly to IPP/631 (or IPPS ) and JetDirect 9100 on the LAN.

Customer

Great — can you recap the Compose and firewall pieces so I can deploy?

Technician

Summary: Use docker-compose with persistent volumes, publish 631 (and 9100 if you need JetDirect), and choose host networking when you require AirPrint discovery. Add LAN‑only bindings and firewall allow‑lists, keep


     cupsd.conf

restricted to


     @LOCAL

, and test with


     curl

nc

. Need a quick review of your docker-compose.yml ? Open the chat and we’ll tune it together.

Quick answer: the accepted fix

Accepted fix when IPP/RAW 9100 from a Docker container is not reachable : publish ports in Compose ( ports: ["631:631","9100:9100"] ), allow only LAN/VPN subnets via firewall, avoid reverse proxies for 9100, and run host networking or avahi sidecar for AirPrint. In cupsd.conf listen on 631, restrict to @LOCAL , and disable public admin.

Port 9100 or IPP 631 blocked after deployment (Docker Compose)

Updates or compose changes can drop published ports. Verify your docker-compose.yml includes the correct ports entries and that the service is healthy . Check host firewalls ( ufw / firewalld /Windows) and router ACLs. If discovery is required, prefer host networking or advertise with avahi .

How to verify the containerized print service

Open http://server:631 to confirm CUPS is reachable. Run nc -vz server 9100 to confirm JetDirect 9100 . Print a 2‑page PDF over IPP ; if jobs stall, inspect /var/log/cups/error_log and ensure the container can reach the physical printer on your LAN (route/NAT/ARP ok).

Containerized printing — deployment & security tips

Most issues come from missing port publishing, blocked firewalls, or mDNS discovery gaps.

Quick path: choose the right network mode → publish 631/9100 → add allow‑lists → set cupsd.conf to @LOCAL → test with curl / nc . Prefer IPP/IPPS for modern clients; use RAW 9100 only when necessary.

Disclaimer: This information is AI-generated and intended for general guidance only. For advice specific to your environment, please consult a verified expert on Whizz-Tech before making decisions.

Getting Started Is Easy

Ask for help, 24/7

Members enjoy round-the-clock access to 12,000+ verified Experts, including tech support, mechanics, vets, and more.

Expert will respond in minutes

We match you with an Expert who specializes in your situation. Talk, text, or chat — whichever you prefer.

Save time & money

No scheduling hassles or expensive consults. Membership can save you significant time and money each month.

FAQ

Why can’t clients reach IPP/631 or RAW/JetDirect 9100 from my Docker container?

Usually the ports aren’t published in Compose, the host firewall blocks them, or a reverse proxy is interfering. Publish 631/9100 directly, allow only LAN/VPN subnets, and avoid proxying 9100.

Is host networking required for AirPrint/Bonjour?

No, but it’s the simplest. With bridge networking you need an avahi sidecar (DBus + --net=host ) or advertise from the host OS so iOS/macOS discover _ipp._tcp / _ipps._tcp .

Is it safe to expose 9100 on the internet?

Do not expose 9100 publicly. Keep it on the LAN/VPN only, enforce firewall allow‑lists, and prefer IPP/IPPS with authentication when possible.

Can I use Traefik/Nginx to proxy printing?

Proxy the CUPS web UI only. Printing should go directly to IPP/631 (optionally IPPS) and RAW 9100 on the LAN.

What’s a minimal docker-compose for CUPS?

Use volumes for /etc/cups and /var/spool/cups , publish 631 (and 9100 if needed), add restart: unless-stopped and a healthcheck . Restrict with firewall and cupsd.conf Require ip @LOCAL .

Common container printing problems and quick fixes
Symptom	Likely cause	Quick fix
IPP works, 9100 fails	9100 not published; proxy in the path	Add ports for 9100 and avoid reverse proxies
Clients can’t discover printer	No mDNS across container boundary	Use host networking or an avahi sidecar
Reachable from WAN	All interfaces binding	Bind to LAN IP only + router/WAN block
Jobs stall	Firewall/NAT or backend path	Allow 631/9100; check `/var/log/cups/error_log`

Step‑by‑step (Docker host)

Choose bridge with ports: ["631:631","9100:9100"] , or host networking if you need AirPrint discovery.
Persist configuration with volumes ( /etc/cups , /var/spool/cups ); add restart and healthcheck .
Harden: bind to LAN IP, allow‑list subnets via firewall, configure cupsd.conf with Require ip @LOCAL .
Test connectivity ( curl for 631, nc for 9100) and send a test page from Windows/macOS/Linux.

Step‑by‑step (Client setup)

On Windows, add an IPP printer ( ipp://server/printers/queue ) or a Standard TCP/IP Port with JetDirect 9100 and the vendor driver.
On macOS, add via AirPrint/IPP or use the IP tab with ipp:// . For legacy devices, use LPD .
Save a preset for color/duplex and verify a two‑page test prints correctly.

Sources

Filed under: Printers

Joe B.

Docker Compose CUPS print server — IPP/IPP Everywhere/AirPrint on 631 and RAW/JetDirect 9100, bridge vs host network

Quick answer: the accepted fix

Port 9100 or IPP 631 blocked after deployment (Docker Compose)

How to verify the containerized print service

Containerized printing — deployment & security tips

Getting Started Is Easy

Ask for help, 24/7

Expert will respond in minutes

Save time & money

FAQ

Step‑by‑step (Docker host)

Step‑by‑step (Client setup)

Sources

Related articles