Repository navigation
runtime: the binary stays on loopback unless told otherwise - #17
Merged
Merged
Conversation
The default was 0.0.0.0:8686 with no token, on the port that writes flows and runs commands through exec connectors. Compose hid it by publishing on localhost, but we also publish the raw binary. The default is now 127.0.0.1:8686. The image sets VEJAS_HTTP_ADDR=0.0.0.0:8686, since loopback inside a container reaches nothing: a bare docker run -p stays as exposed as before, so the runtime warns at boot past loopback with no token, and the install page publishes on localhost. http-in keeps 0.0.0.0 on its own port by design. MANIFESTO.md: the demo is 45 seconds. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_018wXgxT2UoFSZfqhAE1Tb5V
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Le port 8686 écrit des flux et lance des commandes via les connecteurs
exec. Le binaire brut l'ouvrait sur0.0.0.0sans token, alors qu'on le publie à chaque release. Seul le compose cachait le problème.Ce qui change
127.0.0.1:8686par défaut.ENV VEJAS_HTTP_ADDR=0.0.0.0:8686, car un loopback dans un conteneur ne répond à personne. Le compose et les déploiements en conteneur ne changent pas. Reglyze fixe déjà la variable.VEJAS_TOKEN. Undocker run -p 8686:8686reste aussi exposé qu'avant, et le runtime ne peut pas savoir ce qui est publié : refuser de démarrer casserait le compose.ARCHITECTURE, périmètre d'audit, et la page d'installation publie sur localhost.MANIFESTO.md: la démo fait 45 secondes.http-ingarde0.0.0.0sur son propre port, c'est son rôle.Cassant pour qui
Un binaire brut qu'on joignait depuis une autre machine sans fixer
VEJAS_HTTP_ADDRne répond plus. C'est un bump mineur à la prochaine release, écrit dans le changelog.Vérifié
governed-gate,doc-examples,security-traversal.e2e/api-write-gate.shgagne 5 contrôles, exécutés en CI : sans variable le binaire répond sur127.0.0.1:8686etssne montre que le loopback, pas d'avertissement sur loopback, avertissement sur0.0.0.0sans token, aucun avec token.127.0.0.1dans le conteneur, le port publié ne répond pas, ce qui justifie l'ENV.🤖 Generated with Claude Code
https://claude.ai/code/session_018wXgxT2UoFSZfqhAE1Tb5V