Disabling seemingly default services

[emilyyyylime]

I only need ejabberd's SIP support, but it seemed to be a great choice for my use case because it is well maintained, modern, and has the official ejabberd/ecs Docker image on DockerHub. I managed to configure ejabberd for SIP and it seems to work; but when I ran docker ps I was surprised to see despite my very minimal config the container is listening on more than just the SIP ports:

[...]   ejabberd/ecs:23.04   "/sbin/tini -- /home…"   38 minutes ago   Up 38 minutes   
 1883/tcp,
 4369-4399/tcp,
 5222/tcp,
 5269/tcp,
 5280/tcp, 5443/tcp,
 0.0.0.0:5060-5061->5060-5061/tcp,
 0.0.0.0:5060->5060/udp,
 :::5060-5061->5060-5061/tcp,
 :::5060->5060/udp
 [...]

I am assuming this is the result of the wide range of services supported by ejabberd, but I'd really prefer to have those disabled, as I have no use for them.

For reference, my config in its entirety is:

hosts:
  - 0.0.0.0

modules:
  mod_sip: {}

listen:
  - port: 5060
    transport: udp
    module: ejabberd_sip
  - port: 5060
    module: ejabberd_sip
  - port: 5061
    module: ejabberd_sip
    tls: true
    certfile: /home/ejabberd/conf/server.pem

Any help would be greatly appreciated

[badlop]

the container is listening

I imagine the container has those ports opened because Dockerfile says:

EXPOSE 1883 4369-4399 5222 5269 5280 5443

I'd really prefer to have those disabled

ejabberd itself is not listening on them. You can check on ejabberd.log that your case does not show so many opened ports as usual:

2023-08-09 19:16:46.063445+02:00 [info] Start accepting UDP connections at [::]:3478 for ejabberd_stun
2023-08-09 19:16:46.063757+02:00 [info] Start accepting TCP connections at [::]:5222 for ejabberd_c2s
2023-08-09 19:16:46.063774+02:00 [info] Start accepting TLS connections at [::]:5223 for ejabberd_c2s
2023-08-09 19:16:46.063979+02:00 [info] Start accepting TCP connections at [::]:5269 for ejabberd_s2s_in
2023-08-09 19:16:46.064034+02:00 [info] Start accepting TLS connections at [::]:5443 for ejabberd_http
2023-08-09 19:16:46.064073+02:00 [info] Start accepting TCP connections at [::]:5280 for ejabberd_http
2023-08-09 19:16:46.064184+02:00 [info] Start accepting TCP connections at [::]:1883 for mod_mqtt
2023-08-09 19:16:46.064402+02:00 [info] Start accepting TCP connections at 127.0.1.1:7777 for mod_proxy65_stream

BTW, you can take a look at what ports are for services (and you can block), and which ones are for erlang clustering (and dependending on your usage, you can block too):
https://docs.ejabberd.im/admin/guide/security/#firewall-settings