From d575856f2799f04406547f510aeb33d8aee3171a Mon Sep 17 00:00:00 2001
From: Martin <Junkern@users.noreply.github.com>
Date: Tue, 27 Jan 2026 18:39:51 +0100
Subject: [PATCH] fix: docker container stopped ports (#842)

* fix: ports on stopped container force replacement

* chore: Update documentation
---
 docs/v3_v4_migration.md                       |  2 ++
 .../resource_docker_container_funcs.go        | 27 +++++++++++--------
 2 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/docs/v3_v4_migration.md b/docs/v3_v4_migration.md
index 20da0b86..4c4a254f 100644
--- a/docs/v3_v4_migration.md
+++ b/docs/v3_v4_migration.md
@@ -10,6 +10,8 @@ Bump of minimum terraform version to `1.1.5` or newer. This is done as part of i
 Reworked handling of stopped containers: If a container is stopped (or exists for some other reason), Terraform now correctly shows a change on `plan` and restarts the container on `apply`. To trigger the change, the `must_run` attribute is exploited. `must_run` defaults to `true` and when a container is in a not running state, the provider sets `must_run` to `false` to trigger a state change.
 This fixes the cases where a stopped container gets deleted during a `plan`
 
+* Fixes Ports on stopped container force replacement bug (https://github.com/kreuzwerker/terraform-provider-docker/issues/77)
+
 ## `docker_network`
 
 Removed attributes:
diff --git a/internal/provider/resource_docker_container_funcs.go b/internal/provider/resource_docker_container_funcs.go
index 42d8df0f..7a9e4ee8 100644
--- a/internal/provider/resource_docker_container_funcs.go
+++ b/internal/provider/resource_docker_container_funcs.go
@@ -695,6 +695,22 @@ func resourceDockerContainerRead(ctx context.Context, d *schema.ResourceData, me
 	jsonObj, _ := json.MarshalIndent(container, "", "\t")
 	log.Printf("[DEBUG] Docker container inspect from stateFunc: %s", jsonObj)
 
+	// Read Network Settings
+	if container.NetworkSettings != nil {
+		d.Set("bridge", container.NetworkSettings.Bridge)
+		// if the container exited, NetworkSettings.Ports is nil
+		// if we do not need to start the container (must_run is false), we simply do not set the ports with the empty value
+		// That way we can mitigate the bug from https://github.com/kreuzwerker/terraform-provider-docker/issues/77
+		if container.State.Running || d.Get("must_run").(bool) {
+			if err := d.Set("ports", flattenContainerPorts(container.NetworkSettings.Ports)); err != nil {
+				log.Printf("[WARN] failed to set ports from API: %s", err)
+			}
+		}
+		if err := d.Set("network_data", flattenContainerNetworks(container.NetworkSettings)); err != nil {
+			log.Printf("[WARN] failed to set network settings from API: %s", err)
+		}
+	}
+
 	// Check if container is stopped when it should be running
 	// If container is stopped and must_run is true in config, set must_run to false in state
 	// This creates a state drift that Terraform will detect and trigger an update
@@ -709,17 +725,6 @@ func resourceDockerContainerRead(ctx context.Context, d *schema.ResourceData, me
 		}
 	}
 
-	// Read Network Settings
-	if container.NetworkSettings != nil {
-		d.Set("bridge", container.NetworkSettings.Bridge)
-		if err := d.Set("ports", flattenContainerPorts(container.NetworkSettings.Ports)); err != nil {
-			log.Printf("[WARN] failed to set ports from API: %s", err)
-		}
-		if err := d.Set("network_data", flattenContainerNetworks(container.NetworkSettings)); err != nil {
-			log.Printf("[WARN] failed to set network settings from API: %s", err)
-		}
-	}
-
 	// TODO all the other attributes
 	d.SetId(container.ID)
 	d.Set("name", strings.TrimLeft(container.Name, "/")) // api prefixes with '/' ...