diff --git a/docs/yml.md b/docs/yml.md
index df462b17b..24484d4f6 100644
--- a/docs/yml.md
+++ b/docs/yml.md
@@ -44,6 +44,12 @@ ports:
  - "8000:8000"
  - "49100:22"
 
+-- Expose ports without publishing them to the host machine - they'll only be
+-- accessible to linked services. Only the internal port can be specified.
+expose:
+ - "3000"
+ - "8000"
+
 -- Map volumes from the host machine (HOST:CONTAINER).
 volumes:
  - cache/:/tmp/cache
diff --git a/fig/service.py b/fig/service.py
index d07f80d1b..cfc393676 100644
--- a/fig/service.py
+++ b/fig/service.py
@@ -39,7 +39,7 @@ class Service(object):
         if 'image' in options and 'build' in options:
             raise ConfigError('Service %s has both an image and build path specified. A service can either be built to image or use an existing image, not both.' % name)
 
-        supported_options = DOCKER_CONFIG_KEYS + ['build']
+        supported_options = DOCKER_CONFIG_KEYS + ['build', 'expose']
 
         for k in options:
             if k not in supported_options:
@@ -246,9 +246,10 @@ class Service(object):
 
         container_options['name'] = self.next_container_name(one_off)
 
-        if 'ports' in container_options:
+        if 'ports' in container_options or 'expose' in self.options:
             ports = []
-            for port in container_options['ports']:
+            all_ports = container_options.get('ports', []) + self.options.get('expose', [])
+            for port in all_ports:
                 port = str(port)
                 if ':' in port:
                     port = port.split(':')[-1]
diff --git a/tests/service_test.py b/tests/service_test.py
index 458de6762..3448596dc 100644
--- a/tests/service_test.py
+++ b/tests/service_test.py
@@ -212,6 +212,11 @@ class ServiceTest(DockerClientTestCase):
         self.assertEqual(list(container['NetworkSettings']['Ports'].keys()), ['8000/tcp'])
         self.assertNotEqual(container['NetworkSettings']['Ports']['8000/tcp'][0]['HostPort'], '8000')
 
+    def test_expose_does_not_publish_ports(self):
+        service = self.create_service('web', expose=[8000])
+        container = service.start_container().inspect()
+        self.assertEqual(container['NetworkSettings']['Ports'], {'8000/tcp': None})
+
     def test_start_container_creates_port_with_explicit_protocol(self):
         service = self.create_service('web', ports=['8000/udp'])
         container = service.start_container().inspect()