diff --git a/loop/agent.go b/loop/agent.go
index 1527681..438d326 100644
--- a/loop/agent.go
+++ b/loop/agent.go
@@ -375,6 +375,9 @@
 
 	// Track outstanding tool calls by ID with their names
 	outstandingToolCalls map[string]string
+
+	// Port monitoring
+	portMonitor *PortMonitor
 }
 
 // NewIterator implements CodingAgent.
@@ -816,6 +819,7 @@
 		stateMachine:         NewStateMachine(),
 		workingDir:           config.WorkingDir,
 		outsideHTTP:          config.OutsideHTTP,
+		portMonitor:          NewPortMonitor(),
 	}
 	return agent
 }
@@ -1209,6 +1213,12 @@
 }
 
 func (a *Agent) Loop(ctxOuter context.Context) {
+	// Start port monitoring when the agent loop begins
+	// Only monitor ports when running in a container
+	if a.IsInContainer() {
+		a.portMonitor.Start(ctxOuter)
+	}
+
 	for {
 		select {
 		case <-ctxOuter.Done():
diff --git a/loop/port_monitor.go b/loop/port_monitor.go
new file mode 100644
index 0000000..514e928
--- /dev/null
+++ b/loop/port_monitor.go
@@ -0,0 +1,118 @@
+package loop
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"os/exec"
+	"strings"
+	"sync"
+	"time"
+)
+
+// PortMonitor handles periodic monitoring of listening ports in containers
+type PortMonitor struct {
+	mu        sync.Mutex // protects following
+	lastPorts string     // last netstat/ss output for comparison
+}
+
+// NewPortMonitor creates a new PortMonitor instance
+func NewPortMonitor() *PortMonitor {
+	return &PortMonitor{}
+}
+
+// Start begins periodic port monitoring in a background goroutine
+func (pm *PortMonitor) Start(ctx context.Context) {
+	go func() {
+		ticker := time.NewTicker(5 * time.Second) // Check every 5 seconds
+		defer ticker.Stop()
+
+		// Get initial port state
+		pm.updatePortState(ctx)
+
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-ticker.C:
+				pm.updatePortState(ctx)
+			}
+		}
+	}()
+}
+
+// updatePortState runs ss and checks for changes in listening ports
+func (pm *PortMonitor) updatePortState(ctx context.Context) {
+	cmd := exec.CommandContext(ctx, "ss", "-lntu")
+	output, err := cmd.Output()
+	if err != nil {
+		// Log the error but don't fail - port monitoring is not critical
+		slog.DebugContext(ctx, "Failed to run ss command", "error", err)
+		return
+	}
+
+	currentPorts := string(output)
+
+	pm.mu.Lock()
+	defer pm.mu.Unlock()
+
+	// Check if ports have changed
+	if pm.lastPorts != "" && pm.lastPorts != currentPorts {
+		// Ports have changed, log the difference
+		slog.InfoContext(ctx, "Container port changes detected",
+			slog.String("previous_ports", pm.lastPorts),
+			slog.String("current_ports", currentPorts))
+
+		// Parse and compare the port lists for more detailed logging
+		pm.logPortDifferences(ctx, pm.lastPorts, currentPorts)
+	}
+
+	pm.lastPorts = currentPorts
+}
+
+// logPortDifferences parses ss output and logs specific port changes
+func (pm *PortMonitor) logPortDifferences(ctx context.Context, oldPorts, newPorts string) {
+	oldPortSet := parseSSPorts(oldPorts)
+	newPortSet := parseSSPorts(newPorts)
+
+	// Find newly opened ports
+	for port := range newPortSet {
+		if !oldPortSet[port] {
+			slog.InfoContext(ctx, "New port detected", slog.String("port", port))
+		}
+	}
+
+	// Find closed ports
+	for port := range oldPortSet {
+		if !newPortSet[port] {
+			slog.InfoContext(ctx, "Port closed", slog.String("port", port))
+		}
+	}
+}
+
+// parseSSPorts extracts listening ports from ss -lntu output
+// Returns a map with "proto:address:port" as keys
+// ss output format: Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
+func parseSSPorts(output string) map[string]bool {
+	ports := make(map[string]bool)
+	lines := strings.Split(output, "\n")
+
+	for _, line := range lines {
+		fields := strings.Fields(line)
+		if len(fields) < 5 {
+			continue
+		}
+
+		// Skip header line and non-LISTEN states
+		if fields[0] == "Netid" || fields[1] != "LISTEN" {
+			continue
+		}
+
+		proto := fields[0]
+		localAddr := fields[4] // Local Address:Port
+		portKey := fmt.Sprintf("%s:%s", proto, localAddr)
+		ports[portKey] = true
+	}
+
+	return ports
+}
diff --git a/loop/port_monitor_test.go b/loop/port_monitor_test.go
new file mode 100644
index 0000000..8f474e0
--- /dev/null
+++ b/loop/port_monitor_test.go
@@ -0,0 +1,133 @@
+package loop
+
+import (
+	"context"
+	"testing"
+)
+
+// TestPortMonitoring tests the port monitoring functionality
+func TestPortMonitoring(t *testing.T) {
+	// Test with ss output format
+	ssOutput := `Netid State  Recv-Q Send-Q Local Address:Port  Peer Address:PortProcess
+tcp   LISTEN 0      1024       127.0.0.1:40975      0.0.0.0:*          
+tcp   LISTEN 0      4096               *:22               *:*          
+tcp   LISTEN 0      4096               *:80               *:*          
+udp   UNCONN 0      0               127.0.0.1:123            0.0.0.0:*          
+`
+
+	expected := map[string]bool{
+		"tcp:127.0.0.1:40975": true,
+		"tcp:*:22":            true,
+		"tcp:*:80":            true,
+	}
+
+	result := parseSSPorts(ssOutput)
+
+	// Check that all expected ports are found
+	for port := range expected {
+		if !result[port] {
+			t.Errorf("Expected port %s not found in ss parsed output", port)
+		}
+	}
+
+	// Check that UDP port is not included (since it's UNCONN, not LISTEN)
+	if result["udp:127.0.0.1:123"] {
+		t.Errorf("UDP UNCONN port should not be included in listening ports")
+	}
+
+	// Check that no extra ports are found
+	for port := range result {
+		if !expected[port] {
+			t.Errorf("Unexpected port %s found in parsed output", port)
+		}
+	}
+}
+
+// TestPortMonitoringLogDifferences tests the port difference logging
+func TestPortMonitoringLogDifferences(t *testing.T) {
+	ctx := context.Background()
+
+	oldPorts := `Netid State  Recv-Q Send-Q Local Address:Port  Peer Address:PortProcess
+tcp   LISTEN 0      4096               *:22               *:*          
+tcp   LISTEN 0      1024       127.0.0.1:8080      0.0.0.0:*          
+`
+
+	newPorts := `Netid State  Recv-Q Send-Q Local Address:Port  Peer Address:PortProcess
+tcp   LISTEN 0      4096               *:22               *:*          
+tcp   LISTEN 0      1024       127.0.0.1:9090      0.0.0.0:*          
+`
+
+	// Create a port monitor to test the logPortDifferences method
+	pm := NewPortMonitor()
+
+	// This test mainly ensures the method doesn't panic and processes the differences
+	// The actual logging output would need to be captured via a test logger to verify fully
+	pm.logPortDifferences(ctx, oldPorts, newPorts)
+
+	// Test with no differences
+	pm.logPortDifferences(ctx, oldPorts, oldPorts)
+}
+
+// TestPortMonitorCreation tests creating a new port monitor
+func TestPortMonitorCreation(t *testing.T) {
+	pm := NewPortMonitor()
+	if pm == nil {
+		t.Error("NewPortMonitor() returned nil")
+	}
+
+	// Verify initial state
+	pm.mu.Lock()
+	defer pm.mu.Unlock()
+	if pm.lastPorts != "" {
+		t.Error("NewPortMonitor() should have empty lastPorts initially")
+	}
+}
+
+// TestParseSSPortsEdgeCases tests edge cases in ss output parsing
+func TestParseSSPortsEdgeCases(t *testing.T) {
+	tests := []struct {
+		name     string
+		output   string
+		expected map[string]bool
+	}{
+		{
+			name:     "empty output",
+			output:   "",
+			expected: map[string]bool{},
+		},
+		{
+			name:     "header only",
+			output:   "Netid State  Recv-Q Send-Q Local Address:Port  Peer Address:PortProcess",
+			expected: map[string]bool{},
+		},
+		{
+			name:     "non-listen states filtered out",
+			output:   "tcp   ESTAB  0      0       127.0.0.1:8080      127.0.0.1:45678\nudp   UNCONN 0      0       127.0.0.1:123       0.0.0.0:*",
+			expected: map[string]bool{},
+		},
+		{
+			name:     "insufficient fields",
+			output:   "tcp LISTEN 0",
+			expected: map[string]bool{},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			result := parseSSPorts(test.output)
+			if len(result) != len(test.expected) {
+				t.Errorf("Expected %d ports, got %d", len(test.expected), len(result))
+			}
+			for port := range test.expected {
+				if !result[port] {
+					t.Errorf("Expected port %s not found", port)
+				}
+			}
+			for port := range result {
+				if !test.expected[port] {
+					t.Errorf("Unexpected port %s found", port)
+				}
+			}
+		})
+	}
+}