diff --git a/doc/ports.md b/doc/ports.md
index 92753f7a7de6dc96582ace2bdd2766a8e6567ac8..f259e29fef82dac407552d0291eef0bb06e886c1 100644
--- a/doc/ports.md
+++ b/doc/ports.md
@@ -49,6 +49,16 @@ NOTES-3: From haproxy.cfg, following ports should go through haproxy, but are ac
 |  9443 | NiFi web GUI |
 | 12443 | Keycloak | - incorectly configured frontend on port 10443
 
+NOTES-4: There are a number of ports that are just made visible using EXPOSE, but are not actually published, i.e. they cannot be reached directly outside of docker, such as:
+
+| container(s)  | port(s) |
+| ----: | ----------- |
+|   |  |
+|   |  |
+|   |  |
+|   |  |
+|   |  |
+|  |  |
 
 
 Ports already used or reserved for ingesting specific data into the system via NiFi: