diff --git a/doc/ports.md b/doc/ports.md
index a79764b5bf511a05dd79a17853e8098c92d2f1eb..87e464282360ee10562ca369adf6345f972c3645 100644
--- a/doc/ports.md
+++ b/doc/ports.md
@@ -52,6 +52,17 @@ NOTES-3: From haproxy.cfg, following ports should go through haproxy:
 |  9443 | NiFi web GUI |
 | 12443 | Keycloak | - incorectly configured frontend on port 10443
 
+NOTES-4: There are a number of ports that are just made visible using EXPOSE, but are not actually published, i.e. they cannot be reached directly outside of docker, such as
+
+| container(s)  | port(s) |
+| ----: | ----------- |
+|   |  |
+|   |  |
+|   |  |
+|   |  |
+|   |  |
+|  |  |
+
 
 
 Ports already used or reserved for ingesting specific data into the system via NiFi: