[{"data":1,"prerenderedAt":581},["ShallowReactive",2],{"doc-\u002Fdocs\u002Fsecurity\u002Flocalhost-binding":3},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"body":10,"_type":575,"_id":576,"_source":577,"_file":578,"_stem":579,"_extension":580},"\u002Fsecurity\u002Flocalhost-binding","security",false,"","Zero-Trust Localhost Binding","Why strict 127.0.0.1 loopback binding and stateless container labels guarantee zero unauthorized network exposure.",{"type":11,"children":12,"toc":565},"root",[13,21,36,55,59,66,75,82,103,116,336,339,345,362,505,511,559],{"type":14,"tag":15,"props":16,"children":18},"element","h1",{"id":17},"zero-trust-localhost-binding",[19],{"type":20,"value":8},"text",{"type":14,"tag":22,"props":23,"children":24},"p",{},[25,27,34],{"type":20,"value":26},"Standard Docker port mappings often bind to ",{"type":14,"tag":28,"props":29,"children":31},"code",{"className":30},[],[32],{"type":20,"value":33},"0.0.0.0",{"type":20,"value":35},", exposing desktop sessions and management APIs to everyone on your local Wi-Fi, office LAN, or public IP.",{"type":14,"tag":22,"props":37,"children":38},{},[39,45,47,53],{"type":14,"tag":28,"props":40,"children":42},{"className":41},[],[43],{"type":20,"value":44},"webtop-manage",{"type":20,"value":46}," is built around ",{"type":14,"tag":48,"props":49,"children":50},"strong",{},[51],{"type":20,"value":52},"Zero-Trust Loopback Isolation",{"type":20,"value":54},".",{"type":14,"tag":56,"props":57,"children":58},"hr",{},[],{"type":14,"tag":60,"props":61,"children":63},"h2",{"id":62},"the-inbound-threat-model",[64],{"type":20,"value":65},"🔒 The Inbound Threat Model",{"type":14,"tag":67,"props":68,"children":70},"pre",{"code":69},"                 [ Coffee Shop Wi-Fi \u002F LAN ]\n                             │\n                             ✕ (Blocked by 127.0.0.1 Binding)\n                             ▼\n┌────────────────────────────────────────────────────────────┐\n│ Host Machine (Developer Laptop \u002F Server)                   │\n│                                                            │\n│  Management Dashboard ──► http:\u002F\u002F127.0.0.1:8080            │\n│  Webtop Desktops      ──► http:\u002F\u002F127.0.0.1:3000, 3001...   │\n└────────────────────────────────────────────────────────────┘\n",[71],{"type":14,"tag":28,"props":72,"children":73},{"__ignoreMap":7},[74],{"type":20,"value":69},{"type":14,"tag":76,"props":77,"children":79},"h3",{"id":78},"why-default-docker-bindings-are-dangerous",[80],{"type":20,"value":81},"Why Default Docker Bindings Are Dangerous",{"type":14,"tag":22,"props":83,"children":84},{},[85,87,93,95,101],{"type":20,"value":86},"When a container port is published as ",{"type":14,"tag":28,"props":88,"children":90},{"className":89},[],[91],{"type":20,"value":92},"-p 3000:3000",{"type":20,"value":94},", Docker automatically binds to ",{"type":14,"tag":28,"props":96,"children":98},{"className":97},[],[99],{"type":20,"value":100},"0.0.0.0:3000",{"type":20,"value":102},". Anyone on the same network subnet can open your desktop session in their browser without authentication.",{"type":14,"tag":76,"props":104,"children":106},{"id":105},"the-webtop-manage-defense",[107,109,114],{"type":20,"value":108},"The ",{"type":14,"tag":28,"props":110,"children":112},{"className":111},[],[113],{"type":20,"value":44},{"type":20,"value":115}," Defense",{"type":14,"tag":117,"props":118,"children":119},"ol",{},[120,146,318],{"type":14,"tag":121,"props":122,"children":123},"li",{},[124,137,139,145],{"type":14,"tag":48,"props":125,"children":126},{},[127,129,135],{"type":20,"value":128},"Management Daemon (",{"type":14,"tag":28,"props":130,"children":132},{"className":131},[],[133],{"type":20,"value":134},"8080",{"type":20,"value":136},")",{"type":20,"value":138},":\nDocker Compose binds explicitly to ",{"type":14,"tag":28,"props":140,"children":142},{"className":141},[],[143],{"type":20,"value":144},"127.0.0.1:8080:8080",{"type":20,"value":54},{"type":14,"tag":121,"props":147,"children":148},{},[149,161,163,168,170],{"type":14,"tag":48,"props":150,"children":151},{},[152,154,160],{"type":20,"value":153},"Workstation Desktop Ports (",{"type":14,"tag":28,"props":155,"children":157},{"className":156},[],[158],{"type":20,"value":159},"3000+",{"type":20,"value":136},{"type":20,"value":162},":\nDuring container creation, ",{"type":14,"tag":28,"props":164,"children":166},{"className":165},[],[167],{"type":20,"value":44},{"type":20,"value":169}," configures port bindings using explicit loopback host IPs:\n",{"type":14,"tag":67,"props":171,"children":175},{"code":172,"language":173,"meta":7,"className":174,"style":7},"nat.PortMap{\n    \"3000\u002Ftcp\": []nat.PortBinding{\n        {\n            HostIP:   \"127.0.0.1\", \u002F\u002F Enforces loopback binding\n            HostPort: strconv.Itoa(cmd.HostPort),\n        },\n    },\n}\n","go","language-go shiki shiki-themes github-dark github-dark github-light",[176],{"type":14,"tag":28,"props":177,"children":178},{"__ignoreMap":7},[179,206,238,247,272,291,300,309],{"type":14,"tag":180,"props":181,"children":184},"span",{"class":182,"line":183},"line",1,[185,191,196,201],{"type":14,"tag":180,"props":186,"children":188},{"style":187},"--shiki-default:#B392F0;--shiki-dark:#B392F0;--shiki-light:#6F42C1",[189],{"type":20,"value":190},"nat",{"type":14,"tag":180,"props":192,"children":194},{"style":193},"--shiki-default:#E1E4E8;--shiki-dark:#E1E4E8;--shiki-light:#24292E",[195],{"type":20,"value":54},{"type":14,"tag":180,"props":197,"children":198},{"style":187},[199],{"type":20,"value":200},"PortMap",{"type":14,"tag":180,"props":202,"children":203},{"style":193},[204],{"type":20,"value":205},"{\n",{"type":14,"tag":180,"props":207,"children":209},{"class":182,"line":208},2,[210,216,221,225,229,234],{"type":14,"tag":180,"props":211,"children":213},{"style":212},"--shiki-default:#9ECBFF;--shiki-dark:#9ECBFF;--shiki-light:#032F62",[214],{"type":20,"value":215},"    \"3000\u002Ftcp\"",{"type":14,"tag":180,"props":217,"children":218},{"style":193},[219],{"type":20,"value":220},": []",{"type":14,"tag":180,"props":222,"children":223},{"style":187},[224],{"type":20,"value":190},{"type":14,"tag":180,"props":226,"children":227},{"style":193},[228],{"type":20,"value":54},{"type":14,"tag":180,"props":230,"children":231},{"style":187},[232],{"type":20,"value":233},"PortBinding",{"type":14,"tag":180,"props":235,"children":236},{"style":193},[237],{"type":20,"value":205},{"type":14,"tag":180,"props":239,"children":241},{"class":182,"line":240},3,[242],{"type":14,"tag":180,"props":243,"children":244},{"style":193},[245],{"type":20,"value":246},"        {\n",{"type":14,"tag":180,"props":248,"children":250},{"class":182,"line":249},4,[251,256,261,266],{"type":14,"tag":180,"props":252,"children":253},{"style":193},[254],{"type":20,"value":255},"            HostIP:   ",{"type":14,"tag":180,"props":257,"children":258},{"style":212},[259],{"type":20,"value":260},"\"127.0.0.1\"",{"type":14,"tag":180,"props":262,"children":263},{"style":193},[264],{"type":20,"value":265},", ",{"type":14,"tag":180,"props":267,"children":269},{"style":268},"--shiki-default:#6A737D;--shiki-dark:#6A737D;--shiki-light:#6A737D",[270],{"type":20,"value":271},"\u002F\u002F Enforces loopback binding\n",{"type":14,"tag":180,"props":273,"children":275},{"class":182,"line":274},5,[276,281,286],{"type":14,"tag":180,"props":277,"children":278},{"style":193},[279],{"type":20,"value":280},"            HostPort: strconv.",{"type":14,"tag":180,"props":282,"children":283},{"style":187},[284],{"type":20,"value":285},"Itoa",{"type":14,"tag":180,"props":287,"children":288},{"style":193},[289],{"type":20,"value":290},"(cmd.HostPort),\n",{"type":14,"tag":180,"props":292,"children":294},{"class":182,"line":293},6,[295],{"type":14,"tag":180,"props":296,"children":297},{"style":193},[298],{"type":20,"value":299},"        },\n",{"type":14,"tag":180,"props":301,"children":303},{"class":182,"line":302},7,[304],{"type":14,"tag":180,"props":305,"children":306},{"style":193},[307],{"type":20,"value":308},"    },\n",{"type":14,"tag":180,"props":310,"children":312},{"class":182,"line":311},8,[313],{"type":14,"tag":180,"props":314,"children":315},{"style":193},[316],{"type":20,"value":317},"}\n",{"type":14,"tag":121,"props":319,"children":320},{},[321,326,328,334],{"type":14,"tag":48,"props":322,"children":323},{},[324],{"type":20,"value":325},"Connection Refused",{"type":20,"value":327},": Any external connection attempt to ",{"type":14,"tag":28,"props":329,"children":331},{"className":330},[],[332],{"type":20,"value":333},"http:\u002F\u002F\u003Clan-ip>:\u003Cport>",{"type":20,"value":335}," is immediately rejected at the kernel networking layer.",{"type":14,"tag":56,"props":337,"children":338},{},[],{"type":14,"tag":60,"props":340,"children":342},{"id":341},"_100-stateless-zero-db-architecture",[343],{"type":20,"value":344},"📦 100% Stateless Zero-DB Architecture",{"type":14,"tag":22,"props":346,"children":347},{},[348,353,355,360],{"type":14,"tag":28,"props":349,"children":351},{"className":350},[],[352],{"type":20,"value":44},{"type":20,"value":354}," eliminates database synchronization issues, schema migrations, and database corruption risks by storing all workstation metadata directly in ",{"type":14,"tag":48,"props":356,"children":357},{},[358],{"type":20,"value":359},"Docker Container Labels",{"type":20,"value":361},":",{"type":14,"tag":67,"props":363,"children":367},{"code":364,"language":365,"meta":7,"className":366,"style":7},"Labels:\n  webtop.managed: \"true\"\n  webtop.owner: \"sonic-ubuntu-850\"\n  webtop.preset: \"ubuntu-xfce\"\n  webtop.distro: \"ubuntu\"\n  webtop.desktop: \"xfce\"\n  webtop.egress_policy: \"full\"\n  webtop.gpu: \"false\"\n","yaml","language-yaml shiki shiki-themes github-dark github-dark github-light",[368],{"type":14,"tag":28,"props":369,"children":370},{"__ignoreMap":7},[371,385,403,420,437,454,471,488],{"type":14,"tag":180,"props":372,"children":373},{"class":182,"line":183},[374,380],{"type":14,"tag":180,"props":375,"children":377},{"style":376},"--shiki-default:#85E89D;--shiki-dark:#85E89D;--shiki-light:#22863A",[378],{"type":20,"value":379},"Labels",{"type":14,"tag":180,"props":381,"children":382},{"style":193},[383],{"type":20,"value":384},":\n",{"type":14,"tag":180,"props":386,"children":387},{"class":182,"line":208},[388,393,398],{"type":14,"tag":180,"props":389,"children":390},{"style":376},[391],{"type":20,"value":392},"  webtop.managed",{"type":14,"tag":180,"props":394,"children":395},{"style":193},[396],{"type":20,"value":397},": ",{"type":14,"tag":180,"props":399,"children":400},{"style":212},[401],{"type":20,"value":402},"\"true\"\n",{"type":14,"tag":180,"props":404,"children":405},{"class":182,"line":240},[406,411,415],{"type":14,"tag":180,"props":407,"children":408},{"style":376},[409],{"type":20,"value":410},"  webtop.owner",{"type":14,"tag":180,"props":412,"children":413},{"style":193},[414],{"type":20,"value":397},{"type":14,"tag":180,"props":416,"children":417},{"style":212},[418],{"type":20,"value":419},"\"sonic-ubuntu-850\"\n",{"type":14,"tag":180,"props":421,"children":422},{"class":182,"line":249},[423,428,432],{"type":14,"tag":180,"props":424,"children":425},{"style":376},[426],{"type":20,"value":427},"  webtop.preset",{"type":14,"tag":180,"props":429,"children":430},{"style":193},[431],{"type":20,"value":397},{"type":14,"tag":180,"props":433,"children":434},{"style":212},[435],{"type":20,"value":436},"\"ubuntu-xfce\"\n",{"type":14,"tag":180,"props":438,"children":439},{"class":182,"line":274},[440,445,449],{"type":14,"tag":180,"props":441,"children":442},{"style":376},[443],{"type":20,"value":444},"  webtop.distro",{"type":14,"tag":180,"props":446,"children":447},{"style":193},[448],{"type":20,"value":397},{"type":14,"tag":180,"props":450,"children":451},{"style":212},[452],{"type":20,"value":453},"\"ubuntu\"\n",{"type":14,"tag":180,"props":455,"children":456},{"class":182,"line":293},[457,462,466],{"type":14,"tag":180,"props":458,"children":459},{"style":376},[460],{"type":20,"value":461},"  webtop.desktop",{"type":14,"tag":180,"props":463,"children":464},{"style":193},[465],{"type":20,"value":397},{"type":14,"tag":180,"props":467,"children":468},{"style":212},[469],{"type":20,"value":470},"\"xfce\"\n",{"type":14,"tag":180,"props":472,"children":473},{"class":182,"line":302},[474,479,483],{"type":14,"tag":180,"props":475,"children":476},{"style":376},[477],{"type":20,"value":478},"  webtop.egress_policy",{"type":14,"tag":180,"props":480,"children":481},{"style":193},[482],{"type":20,"value":397},{"type":14,"tag":180,"props":484,"children":485},{"style":212},[486],{"type":20,"value":487},"\"full\"\n",{"type":14,"tag":180,"props":489,"children":490},{"class":182,"line":311},[491,496,500],{"type":14,"tag":180,"props":492,"children":493},{"style":376},[494],{"type":20,"value":495},"  webtop.gpu",{"type":14,"tag":180,"props":497,"children":498},{"style":193},[499],{"type":20,"value":397},{"type":14,"tag":180,"props":501,"children":502},{"style":212},[503],{"type":20,"value":504},"\"false\"\n",{"type":14,"tag":76,"props":506,"children":508},{"id":507},"key-architectural-advantages",[509],{"type":20,"value":510},"Key Architectural Advantages",{"type":14,"tag":512,"props":513,"children":514},"ul",{},[515,539,549],{"type":14,"tag":121,"props":516,"children":517},{},[518,523,525,530,532,538],{"type":14,"tag":48,"props":519,"children":520},{},[521],{"type":20,"value":522},"Instant Recovery",{"type":20,"value":524},": If the host restarts, ",{"type":14,"tag":28,"props":526,"children":528},{"className":527},[],[529],{"type":20,"value":44},{"type":20,"value":531}," reconstructs the entire dashboard state on boot in ",{"type":14,"tag":28,"props":533,"children":535},{"className":534},[],[536],{"type":20,"value":537},"\u003C 50ms",{"type":20,"value":54},{"type":14,"tag":121,"props":540,"children":541},{},[542,547],{"type":14,"tag":48,"props":543,"children":544},{},[545],{"type":20,"value":546},"Zero Orphan State",{"type":20,"value":548},": Deleting a container in Docker CLI instantly synchronizes with the web UI upon the next poll or refresh.",{"type":14,"tag":121,"props":550,"children":551},{},[552,557],{"type":14,"tag":48,"props":553,"children":554},{},[555],{"type":20,"value":556},"Portable Snapshots",{"type":20,"value":558},": You can backup, export, or migrate your Docker volumes without touching external database dump files.",{"type":14,"tag":560,"props":561,"children":562},"style",{},[563],{"type":20,"value":564},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}",{"title":7,"searchDepth":240,"depth":240,"links":566},[567,572],{"id":62,"depth":208,"text":65,"children":568},[569,570],{"id":78,"depth":240,"text":81},{"id":105,"depth":240,"text":571},"The webtop-manage Defense",{"id":341,"depth":208,"text":344,"children":573},[574],{"id":507,"depth":240,"text":510},"markdown","content:3.security:1.localhost-binding.md","content","3.security\u002F1.localhost-binding.md","3.security\u002F1.localhost-binding","md",1787169590130]