From 8b29bc6088d3800c9fe9ccbcc7d20fcb09c3b1cf Mon Sep 17 00:00:00 2001 From: Priyanshu-u07 Date: Sun, 18 Oct 2026 07:36:33 +0530 Subject: [PATCH] Publish the orchestration port to the host only Signed-off-by: Priyanshu-u07 --- docker-compose.yml | 2 +- src/tests/deploy/test_compose_ports.py | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index 3d14499a..edc7bd46 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -85,7 +85,7 @@ services: - ${INFERIA_SSH_AUTHORIZED_KEYS_FILE:-./.ssh/authorized_keys}:/var/lib/inferia/ssh/authorized_keys:ro ports: - "${APP_PORT:-8000}:${APP_PORT:-8000}" # Unified web: /api gateway, /inf inference, /v2 OCI mirror, / dashboard - - "8080:8080" # Orchestration service internal port + - "127.0.0.1:8080:8080" # Orchestration, host only: the CLI uses it, nothing remote should deploy: resources: limits: diff --git a/src/tests/deploy/test_compose_ports.py b/src/tests/deploy/test_compose_ports.py index a958a7f3..3cd41553 100644 --- a/src/tests/deploy/test_compose_ports.py +++ b/src/tests/deploy/test_compose_ports.py @@ -24,6 +24,15 @@ def test_envoy_does_not_publish_its_admin_port(): ports = [str(p) for p in _service("front-envoy").get("ports", [])] assert not any("9901" in p for p in ports), f"envoy admin published: {ports}" +def test_orchestration_port_is_published_to_the_host_only(): + ports = [str(p) for p in _app_service().get("ports", [])] + published = [p for p in ports if p.split(":")[-1] == "8080"] + assert published, f"orchestration port no longer published: {ports}" + for p in published: + assert p.startswith("127.0.0.1:"), ( + f"8080 must bind to localhost, some orchestration paths skip the internal key: {p}" + ) + def test_app_does_not_hardcode_mirror_base(): env = _app_service().get("environment", []) # environment may be a list ("K=V") or a dict; normalize to text and assert