From 3d924036db3d9312fbaf3e62bd8f3aeef01d887c Mon Sep 17 00:00:00 2001 From: Aleksandr Lesnenko Date: Fri, 18 Sep 2026 23:27:04 -0400 Subject: [PATCH] bind dev Docker ports, socket REPL, and rspack dev server to loopback only (#82707) --- .env.example | 3 ++ cross-version/docker-compose.yml | 2 +- deps.edn | 6 ++-- dev/docker-compose.yml | 35 +++++++++++-------- docs/developers-guide/dev-branch-docker.md | 4 +-- docs/developers-guide/e2e-tests.md | 2 +- e2e/support/helpers/e2e-email-helpers.js | 2 +- e2e/support/helpers/e2e-ldap-helpers.js | 2 +- .../scenarios/admin-2/settings.cy.spec.js | 2 +- e2e/test/scenarios/docker-compose.yml | 20 +++++------ e2e/test/scenarios/question/saved.cy.spec.js | 2 +- .../semantic_search/docker-compose.yml | 4 +-- .../steps/start-local-metabase-container.ts | 2 +- mage/src/mage/bgrabow/ci_test_repl.clj | 6 ++-- mage/src/mage/bot/dev_env.clj | 2 +- mage/src/mage/edpaget/dev_env.clj | 2 +- mage/src/mage/johnswanson/dev_env.clj | 2 +- mage/src/mage/start_db.clj | 12 +++---- modules/drivers/clickhouse/docker-compose.yml | 26 +++++++------- rspack.main.config.js | 6 +++- snowplow/docker-compose.yml | 2 +- test_resources/ssl/mongo/run-server.sh | 2 +- 22 files changed, 80 insertions(+), 66 deletions(-) diff --git a/.env.example b/.env.example index cb401296fa5..e8761367f7a 100644 --- a/.env.example +++ b/.env.example @@ -121,6 +121,9 @@ MB_EDITION="ee" # Frontend dev server port (for hot reload). Must match the port used by `yarn build-hot`. # MB_FRONTEND_DEV_PORT=8080 +# Frontend dev server bind address. Defaults to 127.0.0.1; set 0.0.0.0 to reach it from other devices. +# MB_FRONTEND_DEV_HOST=127.0.0.1 + # 3.2 E2E Local Runner Setup # ------------------------------------------------------------------------------ diff --git a/cross-version/docker-compose.yml b/cross-version/docker-compose.yml index 846313bf022..77ba3bd3af1 100644 --- a/cross-version/docker-compose.yml +++ b/cross-version/docker-compose.yml @@ -27,7 +27,7 @@ services: metabase: image: ${METABASE_IMAGE:-metabase/metabase:latest} ports: - - "${METABASE_PORT:-3000}:3000" + - "127.0.0.1:${METABASE_PORT:-3000}:3000" environment: MB_DB_TYPE: postgres MB_DB_DBNAME: metabase diff --git a/deps.edn b/deps.edn index cbd0816d465..893405cb365 100644 --- a/deps.edn +++ b/deps.edn @@ -941,8 +941,10 @@ {:extra-deps {nrepl/nrepl {:mvn/version "1.5.1"}} :main-opts ["-m" "nrepl.cmdline" "-p" "50605"]} - ;; - start a Socket REPL on port 50505 that you can connect your editor to: - :socket {:jvm-opts ["-Dclojure.server.repl={:address,\"0.0.0.0\",:port,50505,:accept,clojure.core.server/repl}"]} + ;; - start a Socket REPL on port 50505 that you can connect your editor to. Bound to loopback: it has no + ;; authentication, so exposing it on a network interface is remote code execution. dev/docker-compose.yml + ;; overrides the address for the containerized dev app, where the published port is the boundary. + :socket {:jvm-opts ["-Dclojure.server.repl={:address,\"127.0.0.1\",:port,50505,:accept,clojure.core.server/repl}"]} ;; Liquibase CLI: ;; diff --git a/dev/docker-compose.yml b/dev/docker-compose.yml index a2d0602bace..9f406a96ba1 100644 --- a/dev/docker-compose.yml +++ b/dev/docker-compose.yml @@ -39,8 +39,8 @@ services: image: clojure container_name: metabase-app ports: - - "3001:3000" - - "50505:50505" + - "127.0.0.1:3001:3000" + - "127.0.0.1:50505:50505" working_dir: /dev/metabase volumes: - ../:/dev/metabase @@ -58,7 +58,10 @@ services: MB_POSTGRESQL_TEST_PASSWORD: password MB_POSTGRESQL_TEST_PORT: 5432 MB_POSTGRESQL_TEST_USER: user - command: ["clojure", "-M:run:dev:drivers:drivers-dev:ee:ee-dev:socket"] + # The :socket alias binds the REPL to loopback inside the container, which docker's port + # forwarding can't reach, so bind it to all container interfaces here instead. The host + # side stays loopback-only via the 127.0.0.1: prefix in `ports` above. + command: ["clojure", "-J-Dclojure.server.repl={:address,\"0.0.0.0\",:port,50505,:accept,clojure.core.server/repl}", "-M:run:dev:drivers:drivers-dev:ee:ee-dev"] profiles: - dev-app networks: @@ -79,10 +82,14 @@ services: # the browser loads the bundle from the host's :8080 — it must be # published, not just exposed on the docker network. ports: - - "8080:8080" + - "127.0.0.1:8080:8080" volumes: - ../:/dev/metabase - ~/.bun/install/cache:/root/.bun/install/cache + environment: + # rspack binds to loopback by default; inside the container it must listen on all + # interfaces for docker's port forwarding to reach it. + MB_FRONTEND_DEV_HOST: 0.0.0.0 command: - /bin/sh - -c @@ -99,7 +106,7 @@ services: container_name: metabase-postgres-app-db restart: always ports: - - "5432:5432" + - "127.0.0.1:5432:5432" environment: POSTGRES_USER: mbuser POSTGRES_PASSWORD: password @@ -116,7 +123,7 @@ services: container_name: metabase-mysql57-app-db restart: always ports: - - "3306:3306" + - "127.0.0.1:3306:3306" environment: MYSQL_USER: mbuser MYSQL_PASSWORD: password @@ -138,7 +145,7 @@ services: image: metabase/qa-databases:postgres-sample-14 container_name: metabasedb_postgres_14_data ports: - - "15432:5432" + - "127.0.0.1:15432:5432" restart: always profiles: - postgres14data @@ -149,7 +156,7 @@ services: image: metabase/qa-databases:mysql-sample-5.7 container_name: metabasedb_mysql_5_7_data ports: - - "23306:3306" + - "127.0.0.1:23306:3306" restart: always profiles: - mysql57data @@ -160,7 +167,7 @@ services: image: metabase/qa-databases:mysql-sample-8 container_name: metabasedb_mysql_8_data ports: - - "13306:3306" + - "127.0.0.1:13306:3306" restart: always profiles: - mysql8data @@ -172,7 +179,7 @@ services: container_name: metabasedb_mongo_6_data restart: always ports: - - "27017:27017" + - "127.0.0.1:27017:27017" profiles: - mongodata networks: @@ -183,7 +190,7 @@ services: container_name: vertica_data restart: always ports: - - "5433:5433" + - "127.0.0.1:5433:5433" profiles: - verticadata networks: @@ -195,8 +202,8 @@ services: image: maildev/maildev:latest container_name: maildev ports: - - "1080:1080" - - "1025:1025" + - "127.0.0.1:1080:1080" + - "127.0.0.1:1025:1025" profiles: - pulse networks: @@ -209,7 +216,7 @@ services: - ./idp-private-key.pem:/idp-private-key.pem - ./idp-public-cert.pem:/idp-public-cert.pem ports: - - "7000:7000" + - "127.0.0.1:7000:7000" entrypoint: - node - app.js diff --git a/docs/developers-guide/dev-branch-docker.md b/docs/developers-guide/dev-branch-docker.md index 893f80fafcf..1bcb8b2b4b8 100644 --- a/docs/developers-guide/dev-branch-docker.md +++ b/docs/developers-guide/dev-branch-docker.md @@ -33,7 +33,7 @@ Once Docker is installed, you’re ready to go. 2. Copy and paste this command, switching out `` for the name of the branch you’d like to test: ```bash -docker run --platform linux/amd64 -d -p 3000:3000 --name metabase-dev metabase/metabase-dev: +docker run --platform linux/amd64 -d -p 127.0.0.1:3000:3000 --name metabase-dev metabase/metabase-dev: ``` 3. In your browser, navigate to `http://localhost:3000`, where you should see Metabase. It may take a minute or two to start up depending on your computer. @@ -51,7 +51,7 @@ docker pull metabase/metabase-enterprise-head:latest Then: ``` -docker run --platform linux/amd64 -d -p 3000:3000 --name metabase metabase/metabase-enterprise-head:latest +docker run --platform linux/amd64 -d -p 127.0.0.1:3000:3000 --name metabase metabase/metabase-enterprise-head:latest ``` The “latest” tag is not automatically upgraded on your local machine, so the above commands ensure that you’re pulling the latest changes. diff --git a/docs/developers-guide/e2e-tests.md b/docs/developers-guide/e2e-tests.md index a566b8d0291..c1d2e1c34ca 100644 --- a/docs/developers-guide/e2e-tests.md +++ b/docs/developers-guide/e2e-tests.md @@ -171,7 +171,7 @@ We have a few helpers for dealing with tests involving snowplow Some of our tests depend on the email being set up, and require a local SMTP server. We use `maildev` Docker image for that purpose. At the time of this writing the image we use is `maildev/maildev:2.1.0`. The default cypress configuration for local development will handle this for you. If you want to set it up manually, you can use this command: ```sh -docker run -d -p 1180:1080 -p 1125:1025 maildev/maildev:2.2.1 +docker run -d -p 127.0.0.1:1180:1080 -p 127.0.0.1:1125:1025 maildev/maildev:2.2.1 ``` The e2e maildev is published on host ports 1180 (web UI) and 1125 (SMTP) on purpose. These differ, on purpose, from the 1080/1025 used for development. diff --git a/e2e/support/helpers/e2e-email-helpers.js b/e2e/support/helpers/e2e-email-helpers.js index 150c004e195..80255136640 100644 --- a/e2e/support/helpers/e2e-email-helpers.js +++ b/e2e/support/helpers/e2e-email-helpers.js @@ -13,7 +13,7 @@ const { WEB_PORT, SMTP_PORT } = WEBMAIL_CONFIG; /** * `bun run test-cypress` starts maildev for you via * e2e/test/scenarios/docker-compose.yml. To start it manually instead: - * `docker run -d -p 1180:1080 -p 1125:1025 maildev/maildev:2.2.1` + * `docker run -d -p 127.0.0.1:1180:1080 -p 127.0.0.1:1125:1025 maildev/maildev:2.2.1` * or * `npx maildev -s 1125 -w 1180` */ diff --git a/e2e/support/helpers/e2e-ldap-helpers.js b/e2e/support/helpers/e2e-ldap-helpers.js index c305757f2b2..d2f2e8d73fd 100644 --- a/e2e/support/helpers/e2e-ldap-helpers.js +++ b/e2e/support/helpers/e2e-ldap-helpers.js @@ -1,6 +1,6 @@ /** Make sure you have the ldap test server running locally: - docker run -p 389:389 \ + docker run -p 127.0.0.1:389:389 \ --env LDAP_ADMIN_PASSWORD=adminpass \ --env LDAP_USERS=user01@example.org,user02@example.org \ --env LDAP_PASSWORDS=123456,123465 \ diff --git a/e2e/test/scenarios/admin-2/settings.cy.spec.js b/e2e/test/scenarios/admin-2/settings.cy.spec.js index c2e738c4a45..f5d5506df99 100644 --- a/e2e/test/scenarios/admin-2/settings.cy.spec.js +++ b/e2e/test/scenarios/admin-2/settings.cy.spec.js @@ -883,7 +883,7 @@ describe("scenarios > admin > settings > map settings", () => { }); // Ensure the webhook tester docker container is running -// docker run -p 9080:8080/tcp tarampampam/webhook-tester:1.1.0 serve --create-session 00000000-0000-0000-0000-000000000000 +// docker run -p 127.0.0.1:9080:8080/tcp tarampampam/webhook-tester:1.1.0 serve --create-session 00000000-0000-0000-0000-000000000000 describe("notifications", { tags: "@external" }, () => { beforeEach(() => { H.resetWebhookTester(); diff --git a/e2e/test/scenarios/docker-compose.yml b/e2e/test/scenarios/docker-compose.yml index ecb4463ff20..7e8e1fc0c19 100644 --- a/e2e/test/scenarios/docker-compose.yml +++ b/e2e/test/scenarios/docker-compose.yml @@ -9,32 +9,32 @@ services: - TZ=US/Pacific image: metabase/qa-databases:postgres-sample-12 ports: - - 5404:5432 + - 127.0.0.1:5404:5432 mongo-sample: image: metabase/qa-databases:mongo-sample-5 ports: - - 27004:27017 + - 127.0.0.1:27004:27017 mysql-sample: environment: - TZ=US/Pacific image: metabase/qa-databases:mysql-sample-8 ports: - - 3304:3306 + - 127.0.0.1:3304:3306 webhook-tester: image: tarampampam/webhook-tester:1.1.0 ports: - - 9080:8080 + - 127.0.0.1:9080:8080 command: serve --create-session 00000000-0000-0000-0000-000000000000 maildev: image: maildev/maildev:2.2.1 ## Host ports deliberately differ from the 1080/1025 used for development ports: - - "1180:1080" - - "1125:1025" + - "127.0.0.1:1180:1080" + - "127.0.0.1:1125:1025" maildev-ssl: ## NOTE: Using this requires a root CA certificate to be added to the Java keystore. @@ -43,8 +43,8 @@ services: ## breaks the SSL/SMTP setup and fails the custom SMTP e2e tests. image: maildev/maildev:2.2.1 ports: - - "1081:1081" - - "465:465" + - "127.0.0.1:1081:1081" + - "127.0.0.1:465:465" environment: NODE_TLS_REJECT_UNAUTHORIZED: 0 MAILDEV_WEB_PORT: 1081 @@ -58,7 +58,7 @@ services: saml-idp: image: boxyhq/mock-saml:1.4.2 ports: - - "8090:4000" + - "127.0.0.1:8090:4000" environment: APP_URL: http://localhost:8090 ENTITY_ID: https://saml.example.com/entityid @@ -68,7 +68,7 @@ services: ldap: image: bitnamilegacy/openldap:2.6.4 ports: - - "389:389" + - "127.0.0.1:389:389" environment: LDAP_ADMIN_PASSWORD: adminpass LDAP_USERS: user01@example.org,user02@example.org diff --git a/e2e/test/scenarios/question/saved.cy.spec.js b/e2e/test/scenarios/question/saved.cy.spec.js index f9fcf3a574f..967c7993e0b 100644 --- a/e2e/test/scenarios/question/saved.cy.spec.js +++ b/e2e/test/scenarios/question/saved.cy.spec.js @@ -592,7 +592,7 @@ describe("scenarios > question > saved", () => { //http://127.0.0.1:9080/api/session/00000000-0000-0000-0000-000000000000/requests // Ensure the webhook tester docker container is running -// docker run -p 9080:8080/tcp tarampampam/webhook-tester:1.1.0 serve --create-session 00000000-0000-0000-0000-000000000000 +// docker run -p 127.0.0.1:9080:8080/tcp tarampampam/webhook-tester:1.1.0 serve --create-session 00000000-0000-0000-0000-000000000000 describe( "scenarios > question > saved > alerts", { tags: ["@external"] }, diff --git a/enterprise/backend/src/metabase_enterprise/semantic_search/docker-compose.yml b/enterprise/backend/src/metabase_enterprise/semantic_search/docker-compose.yml index a3083464ed7..dfa8e2ada01 100644 --- a/enterprise/backend/src/metabase_enterprise/semantic_search/docker-compose.yml +++ b/enterprise/backend/src/metabase_enterprise/semantic_search/docker-compose.yml @@ -13,7 +13,7 @@ services: POSTGRES_USER: postgres POSTGRES_PASSWORD: postgres ports: - - "55432:5432" + - "127.0.0.1:55432:5432" volumes: - pgvector17_data:/var/lib/postgresql/data healthcheck: @@ -25,7 +25,7 @@ services: ollama: image: ollama/ollama:latest ports: - - "11434:11434" + - "127.0.0.1:11434:11434" volumes: - ollama_data:/root/.ollama healthcheck: diff --git a/enterprise/frontend/src/embedding-sdk-package/cli/steps/start-local-metabase-container.ts b/enterprise/frontend/src/embedding-sdk-package/cli/steps/start-local-metabase-container.ts index 0bca5b1d803..ca80797702a 100644 --- a/enterprise/frontend/src/embedding-sdk-package/cli/steps/start-local-metabase-container.ts +++ b/enterprise/frontend/src/embedding-sdk-package/cli/steps/start-local-metabase-container.ts @@ -104,7 +104,7 @@ export const startLocalMetabaseContainer: CliStepMethod = async (state) => { .join(" "); const { stderr, stdout } = await exec( - `docker run --pull always --detach -p ${port}:3000 ${envFlags} --name ${CONTAINER_NAME} ${IMAGE_NAME}`, + `docker run --pull always --detach -p 127.0.0.1:${port}:3000 ${envFlags} --name ${CONTAINER_NAME} ${IMAGE_NAME}`, ); if (stdout) { diff --git a/mage/src/mage/bgrabow/ci_test_repl.clj b/mage/src/mage/bgrabow/ci_test_repl.clj index 5b44aa4d604..7e1d3af2324 100644 --- a/mage/src/mage/bgrabow/ci_test_repl.clj +++ b/mage/src/mage/bgrabow/ci_test_repl.clj @@ -227,7 +227,7 @@ container-name (str container-prefix "-" suffix) host-port (host-port-for-image image ci-port-mapping) container-port (second (str/split ci-port-mapping #":")) - port-mapping (str host-port ":" container-port) + port-mapping (str "127.0.0.1:" host-port ":" container-port) current-image (running-container-image container-name)] (if (= current-image image) (do (println (c/green "Reusing existing") container-name (str "(" image ")")) @@ -378,7 +378,7 @@ container-name (str container-prefix "-" suffix) host-port (host-port-for-image image ci-ports) container-port (second (str/split ci-ports #":")) - port-mapping (str host-port ":" container-port) + port-mapping (str "127.0.0.1:" host-port ":" container-port) env-args (mapcat (fn [[k v]] ["-e" (str (name k) "=" v)]) (or svc-env {}))]] (vec (concat ["docker" "run" "-d" "--name" container-name @@ -441,7 +441,6 @@ (println) (println (c/bold (str "=== CI Test REPL: " (display-name test-job) " ==="))) (println) - ;; Start Docker services and collect port remappings (let [port-remaps (if (has-services? test-job) (start-services! test-job) @@ -451,7 +450,6 @@ (println (c/bold "Starting nREPL") "(aliases: :dev:ee:ee-dev:drivers:drivers-dev)...") (println "To stop containers:" (c/green (str "docker rm -f $(docker ps -q --filter name=" container-prefix ")"))) (println) - ;; Replace this process with the nREPL (like shell `exec`) (let [extra-env (into {} (map (fn [[k v]] [(name k) (str v)]) ci-env))] (process/exec {:extra-env extra-env} diff --git a/mage/src/mage/bot/dev_env.clj b/mage/src/mage/bot/dev_env.clj index a298f96b7e5..4b5545c1259 100644 --- a/mage/src/mage/bot/dev_env.clj +++ b/mage/src/mage/bot/dev_env.clj @@ -135,7 +135,7 @@ (into ["docker" "run" "-d"] (concat (mapcat (fn [[host-port internal-port]] - ["-p" (str host-port ":" internal-port)]) + ["-p" (str "127.0.0.1:" host-port ":" internal-port)]) port-mappings) (mapcat (fn [[k v]] ["-e" (str k "=" v)]) diff --git a/mage/src/mage/edpaget/dev_env.clj b/mage/src/mage/edpaget/dev_env.clj index 1e2ec6f44b6..43335dc38af 100644 --- a/mage/src/mage/edpaget/dev_env.clj +++ b/mage/src/mage/edpaget/dev_env.clj @@ -115,7 +115,7 @@ (into ["docker" "run" "-d"] (concat (mapcat (fn [[host-port internal-port]] - ["-p" (str host-port ":" internal-port)]) + ["-p" (str "127.0.0.1:" host-port ":" internal-port)]) port-mappings) (mapcat (fn [[k v]] ["-e" (str k "=" v)]) diff --git a/mage/src/mage/johnswanson/dev_env.clj b/mage/src/mage/johnswanson/dev_env.clj index e96dee20251..df6e5cad943 100644 --- a/mage/src/mage/johnswanson/dev_env.clj +++ b/mage/src/mage/johnswanson/dev_env.clj @@ -126,7 +126,7 @@ (into ["docker" "run" "-d"] (concat (mapcat (fn [[host-port internal-port]] - ["-p" (str host-port ":" internal-port)]) + ["-p" (str "127.0.0.1:" host-port ":" internal-port)]) port-mappings) (mapcat (fn [[k v]] ["-e" (str k "=" v)]) diff --git a/mage/src/mage/start_db.clj b/mage/src/mage/start_db.clj index 63cd5070b70..295d853dea5 100644 --- a/mage/src/mage/start_db.clj +++ b/mage/src/mage/start_db.clj @@ -92,7 +92,7 @@ (defmethod docker-cmd :postgres [_db container-name resolved-version port] ["docker" "run" "-d" - "-p" (str port ":5432") + "-p" (str "127.0.0.1:" port ":5432") ;; "--network" "psql-metabase-network" "-e" "POSTGRES_USER=metabase" "-e" "POSTGRES_DB=metabase" @@ -105,7 +105,7 @@ (defmethod docker-cmd :mysql [_db container-name resolved-version port] ["docker" "run" "-d" - "-p" (str port ":3306") + "-p" (str "127.0.0.1:" port ":3306") "-e" "MYSQL_DATABASE=metabase_test" "-e" "MYSQL_ALLOW_EMPTY_PASSWORD=yes" "--name" container-name @@ -114,7 +114,7 @@ (defmethod docker-cmd :mariadb [_db container-name resolved-version port] ["docker" "run" "-d" - "-p" (str port ":3306") + "-p" (str "127.0.0.1:" port ":3306") "-e" "MYSQL_DATABASE=metabase_test" "-e" "MYSQL_ALLOW_EMPTY_PASSWORD=yes" "--name" container-name @@ -125,7 +125,7 @@ ["docker" "run" "-d" "-e" "MONGO_INITDB_ROOT_USERNAME=metabase" "-e" "MONGO_INITDB_ROOT_PASSWORD=metasample123" - "-p" (str port ":27017") + "-p" (str "127.0.0.1:" port ":27017") "--name" container-name (str "mongo:" resolved-version)]) @@ -141,7 +141,7 @@ (defmethod docker-cmd :sqlserver [_db container-name resolved-version port] ["docker" "run" "-d" - "-p" (str port ":1433") + "-p" (str "127.0.0.1:" port ":1433") "-e" "ACCEPT_EULA=Y" "-e" "SA_PASSWORD=P@ssw0rd" "--name" container-name @@ -150,7 +150,7 @@ (defmethod docker-cmd :oracle [_db container-name resolved-version port] ["docker" "run" "-d" - "-p" (str port ":1521") + "-p" (str "127.0.0.1:" port ":1521") "-e" "ORACLE_PASSWORD=password" "--name" container-name (if (= resolved-version "latest") diff --git a/modules/drivers/clickhouse/docker-compose.yml b/modules/drivers/clickhouse/docker-compose.yml index 7869a4d0582..06d60d29d31 100644 --- a/modules/drivers/clickhouse/docker-compose.yml +++ b/modules/drivers/clickhouse/docker-compose.yml @@ -9,8 +9,8 @@ services: container_name: 'mb-clickhouse-latest' hostname: clickhouse ports: - - '8123:8123' - - '9000:9000' + - '127.0.0.1:8123:8123' + - '127.0.0.1:9000:9000' environment: CLICKHOUSE_SKIP_USER_SETUP: 1 ulimits: @@ -32,8 +32,8 @@ services: dockerfile: .docker/clickhouse/single_node_tls/Dockerfile container_name: 'metabase-driver-clickhouse-server-tls' ports: - - '8443:8443' - - '9440:9440' + - '127.0.0.1:8443:8443' + - '127.0.0.1:9440:9440' environment: CLICKHOUSE_SKIP_USER_SETUP: 1 ulimits: @@ -56,8 +56,8 @@ services: container_name: 'mb-clickhouse-oldest' hostname: clickhouse.older ports: - - '8124:8123' - - '9001:9000' + - '127.0.0.1:8124:8123' + - '127.0.0.1:9001:9000' environment: CLICKHOUSE_SKIP_USER_SETUP: 1 ulimits: @@ -82,9 +82,9 @@ services: hostname: clickhouse1 container_name: metabase-driver-clickhouse-cluster-node-1 ports: - - '8125:8123' - - '9002:9000' - - '9181:9181' + - '127.0.0.1:8125:8123' + - '127.0.0.1:9002:9000' + - '127.0.0.1:9181:9181' environment: CLICKHOUSE_SKIP_USER_SETUP: 1 volumes: @@ -101,9 +101,9 @@ services: hostname: clickhouse2 container_name: metabase-driver-clickhouse-cluster-node-2 ports: - - '8126:8123' - - '9003:9000' - - '9182:9181' + - '127.0.0.1:8126:8123' + - '127.0.0.1:9003:9000' + - '127.0.0.1:9182:9181' environment: CLICKHOUSE_SKIP_USER_SETUP: 1 volumes: @@ -117,7 +117,7 @@ services: image: 'nginx:1.23.1-alpine' hostname: nginx ports: - - '8127:8123' + - '127.0.0.1:8127:8123' volumes: - './.docker/nginx/local.conf:/etc/nginx/conf.d/local.conf' container_name: metabase-nginx diff --git a/rspack.main.config.js b/rspack.main.config.js index aa04f1aca30..ed92cb3a5ee 100644 --- a/rspack.main.config.js +++ b/rspack.main.config.js @@ -49,6 +49,10 @@ const isEEBuild = process.env.MB_EDITION === "ee"; const SDK_DOCS_SNIPPETS_PATH = __dirname + "/docs/embedding/sdk/snippets"; const PORT = process.env.MB_FRONTEND_DEV_PORT || 8080; +// Bind to loopback by default so the hot-reload server is not reachable from the +// local network. Set MB_FRONTEND_DEV_HOST=0.0.0.0 to serve it to other devices +// (or from inside a container, where the published port is the boundary). +const HOST = process.env.MB_FRONTEND_DEV_HOST || "127.0.0.1"; const isDevMode = IS_DEV_MODE; const shouldEnableHotRefresh = WEBPACK_BUNDLE === "hot"; @@ -465,7 +469,7 @@ if (shouldEnableHotRefresh) { // if you want to reduce stats noise // stats: 'minimal' // values: none, errors-only, minimal, normal, verbose }, - host: "0.0.0.0", + host: HOST, }; config.watchOptions = { diff --git a/snowplow/docker-compose.yml b/snowplow/docker-compose.yml index 7fcf0cb0673..81b34fbd2c7 100644 --- a/snowplow/docker-compose.yml +++ b/snowplow/docker-compose.yml @@ -2,7 +2,7 @@ services: snowplow-micro: image: snowplow/snowplow-micro:2.3.0 ports: - - "9090:9090" + - "127.0.0.1:9090:9090" volumes: - .:/config command: "--collector-config /config/micro.conf --iglu /config/iglu.json" diff --git a/test_resources/ssl/mongo/run-server.sh b/test_resources/ssl/mongo/run-server.sh index 8f8d944d0cd..3509e5ac7ad 100755 --- a/test_resources/ssl/mongo/run-server.sh +++ b/test_resources/ssl/mongo/run-server.sh @@ -33,7 +33,7 @@ fi echo "Running mongod version ${version} in SSL mode ${ssl}" -docker run -d -it --rm -p 27017:27017 --name metamongo \ +docker run -d -it --rm -p 127.0.0.1:27017:27017 --name metamongo \ -e MONGO_INITDB_ROOT_USERNAME=metabase \ -e MONGO_INITDB_ROOT_PASSWORD=metasample123 \ metabase/qa-databases:mongo-sample-${version} \