fix(security): bind container ports to localhost and remove credentials from debug logs

commit: c17014f3f9f4e3e6787c1db751ad8fb156ede7aa
author: bnema · 8mo ago · 2026-02-01 14:32 UTC
parent: 795aa51
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

1 file · +6 -3

M internal/adapters/out/docker/runtime.go +6 -3


@@ -69,10 +69,13 @@ func (r Runtime) CreateContainer(ctx context.Context, config domain.ContainerC
69	69		containerPort := nat.Port(fmt.Sprintf("%d/tcp", port))
70	70		exposedPorts[containerPort] = struct{}{}
71	71
72		-	// Bind to random available port on host
	72	+	// Bind to random available port on localhost only.
	73	+	// SECURITY: Using 127.0.0.1 prevents direct access from the network,
	74	+	// forcing all traffic through Gordon's reverse proxy where auth,
	75	+	// rate limiting, and security headers are applied.
73	76		portBindings[containerPort] = []nat.PortBinding{
74	77		{
75		-	HostIP: "0.0.0.0",
	78	+	HostIP: "127.0.0.1",
76	79		HostPort: "0", // Docker will assign a random available port
77	80		},
78	81		}

@@ -407,7 +410,7 @@ func (r *Runtime) PullImageWithAuth(ctx context.Context, imageRef, username, pas
407	410
408	411		log.Debug().
409	412		Str("server_address", serverAddress).
410		-	Str("auth_json", string(authConfigBytes)).
	413	+	Bool("has_auth", len(authConfigBytes) > 0).
411	414		Msg("auth config for pull")
412	415
413	416		// Pull with authentication

 		containerPort := nat.Port(fmt.Sprintf("%d/tcp", port))
 		exposedPorts[containerPort] = struct{}{}
-		// Bind to random available port on host
+		// Bind to random available port on localhost only.
+		// SECURITY: Using 127.0.0.1 prevents direct access from the network,
+		// forcing all traffic through Gordon's reverse proxy where auth,
+		// rate limiting, and security headers are applied.
 		portBindings[containerPort] = []nat.PortBinding{
 			{
-				HostIP:   "0.0.0.0",
+				HostIP:   "127.0.0.1",
 				HostPort: "0", // Docker will assign a random available port
 			},
 		}
 	log.Debug().
 		Str("server_address", serverAddress).
-		Str("auth_json", string(authConfigBytes)).
+		Bool("has_auth", len(authConfigBytes) > 0).
 		Msg("auth config for pull")
 	// Pull with authentication