Skip to content

fix(deploy): surface loopback-only Docker ports for review - #1131

Open
Metehan-Bicer wants to merge 4 commits into
oblien:mainfrom
Metehan-Bicer:fix/port-check-loopback-only
Open

Metehan-Bicer wants to merge 4 commits into
oblien:mainfrom
Metehan-Bicer:fix/port-check-loopback-only

Conversation

@Metehan-Bicer

@Metehan-Bicer Metehan-Bicer commented Oct 10, 2026 •

Copy link
Copy Markdown

Summary

A Docker app can listen successfully on container loopback while requests through its published route fail. Report that confirmed binding problem as Action required through the existing deployment port review and Monitoring. The release remains running.

The review explains how to configure the app or route to its intended proxy and links to its settings. The existing wrong-port editor remains available for missing listeners. Partial-deployment decisions are handled before port review, so those dialogs do not open together. The Domains page uses the same diagnosis for its live port hint.

Changes

  • Read both IPv4 and IPv6 socket tables before asserting loopback exclusivity. Preserve a positively observed listener when one read fails. Bare apps and port-ownership probes retain their existing behavior.
  • Carry the optional binding result through the shared port-check type, persisted deployment metadata, API/SDK contract and existing pending actions. Reuse the existing review modal and dismissal endpoint.
  • Wait for dismissal confirmation, keep failures retryable, and scope late responses to their original deployment. Append dismissals atomically without replacing deployment status or other metadata.
  • Add localized guidance and troubleshooting documentation.

Validation

  • 239 targeted tests passed across port probes/ownership, engine audit, pending actions, deployment review, domain hints, state restoration and database persistence.
  • Typechecks passed for API, dashboard, core, contracts, database, adapters and platform.
  • Packaged SDK/CLI build passed.
  • Full bun run test: 10 successful tasks, 19,890 tests passed and 7 existing skips.
  • bun run docs:check passed: documentation links, shared API/MCP reference, built CLI help and all CLI/SDK examples.
  • Structured error-boundary audit passed.
  • CI for 6a03906d: all checks passed, including edge routing and Cloud Docker workspaces.

The added regressions reproduced incomplete socket-read false positives, dropped binding results, and missing pending actions/build-page status on the previous implementation. Database tests use real PGlite for concurrent dismissals and metadata/status preservation.

Related issue

Addresses the loopback-binding diagnosis in #1022. This change reports the condition; it does not automatically reconfigure an application or create a proxy.

Metehan-Bicer and others added 3 commits October 10, 2026 22:00
The port check read /proc/net/tcp inside the container but kept only the
port of each LISTEN row, so an app bound to 127.0.0.1 counted as
listening although the edge, which reaches a Docker deployment through
the container's own address, gets no answer. On the docker runtime such
a port now logs a warning instead of "is listening"; the result stays
listening, and the bare runtime is unchanged.

Refs oblien#1022
@Hydralerne Hydralerne changed the title fix(deploy): warn when a Docker app only listens on loopback fix(deploy): surface loopback-only Docker ports for review Oct 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants