Prove the container listener before wiring private service ports

Prove the actual listener port of every deployed container before wiring a private-service bridge, health probe, or sidecar. Framework defaults, platform-injected variables, and image generations can make a worker listen on a different port than the public web service even when they share a repository. Check startup logs and a direct authenticated readiness probe, then bind the bridge to that observed port. Re-check after a release that changes start commands or runtime defaults. This does not replace application-level readiness or identity checks.

Applies when: Several services share code but run different commands, images, or platform environments. Keywords: Railway container listener port private service bridge health probe runtime