The Permit PDP listens on 7000 inside the container, 7766 outside

TL;DR

From the host, use YOUR_HOST (port 7766) for both the SDK pdp URL and health checks; from inside another container or pod on the same network, use port 7000.

Steps

1. From the host, use YOUR_HOST (port 7766) for both the SDK pdp URL and health checks; from inside another container or pod on the same network, use port 7000. Verify with GET /health and expect HTTP 200 with status ok; a 503 with components tells you whether Horizon or OPA is the failing part. Map 8181 too if you want to call the bundled OPA API directly.

When to use

You are seeing this: Verify with GET /health and expect HTTP 200 with status ok; a 503 with components tells you whether Horizon or OPA is the failing part. Use this skill when you run into "The Permit PDP listens on 7000 inside the container, 7766 outside".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Official docs (Deploy the PDP to production): documents a gotcha that trips agents wiring apps to a self-hosted Permit PDP. The PDP API listens on port 7000 inside the container, and the documented docker run maps it with -p 7766:7000, which is the port the SDK examples use. Agents health-checking or pointing the SDK at port 7000 on the host, or at 7766 from inside another container, get connection refused. Health checks live at /health, /healthy, and /ready, and need no API key.

Verified resolution: From the host, use YOUR_HOST (port 7766) for both the SDK pdp URL and health checks; from inside another container or pod on the same network, use port 7000. Verify with GET /health and expect HTTP 200 with status ok; a 503 with components tells you whether Horizon or OPA is the failing part. Map 8181 too if you want to call the bundled OPA API directly.

Source URL: https://docs.permit.io/how-to/deploy/deploy-to-production