From 81ee932fbe3bbb6503e604688d197e38f7c1c0a1 Mon Sep 17 00:00:00 2001
From: JingWen Fan <106414602+study8677@users.noreply.github.com>
Date: Wed, 20 May 2026 18:00:26 +0800
Subject: [PATCH] fix: restrict docker exposure to localhost by default

---
 Dockerfile         | 1 -
 docker-compose.yml | 4 +++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 4d0aa2e..71fdbc2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -21,6 +21,5 @@ RUN playwright install-deps chromium \
 COPY --from=frontend-builder /app/frontend/dist ./frontend/dist
 VOLUME ["/data"]
 ENV OPENCMO_DB_PATH=/data/data.db
-ENV OPENCMO_WEB_HOST=0.0.0.0
 EXPOSE 8080
 CMD ["opencmo-web"]
diff --git a/docker-compose.yml b/docker-compose.yml
index 3e60e5b..76714c5 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -2,7 +2,9 @@ services:
   opencmo:
     build: .
     ports:
-      - "8080:8080"
+      - "127.0.0.1:8080:8080"
+    environment:
+      - OPENCMO_WEB_HOST=0.0.0.0
     volumes:
       - opencmo_data:/data
     env_file: