buildPodmanRunArgs maps the web UI port with -p <hostPort>:8080, with no address prefix, so Podman and Docker bind 0.0.0.0. A default omnideck setup therefore puts the instance on the local network.
That matters more than a normal service, because what is behind the port runs arbitrary code and drives a browser. Anything on the same wifi can reach it, and nothing about the setup output suggests it is exposed.
The desktop application binds 127.0.0.1:<port>:8080 and has a test named for it, so the two ways of running Omnideck currently differ on this.
Where
engine/podman.go — buildPodmanRunArgsengine/docker.go — the equivalent argument builderengine/engine_test.go asserts "2337:8080", so the tests pin the current behaviour
Suggestion
Bind loopback by default and make reaching it from elsewhere an explicit choice — something like --listen 0.0.0.0 at setup, stored per instance. Remote access is a reasonable thing for an administrator to want; it just should not be what happens when nobody asked.
This is a default change that affects anyone already relying on remote access, which is why it is filed rather than fixed.
buildPodmanRunArgsmaps the web UI port with-p <hostPort>:8080, with no address prefix, so Podman and Docker bind0.0.0.0. A defaultomnideck setuptherefore puts the instance on the local network.That matters more than a normal service, because what is behind the port runs arbitrary code and drives a browser. Anything on the same wifi can reach it, and nothing about the setup output suggests it is exposed.
The desktop application binds
127.0.0.1:<port>:8080and has a test named for it, so the two ways of running Omnideck currently differ on this.Where
engine/podman.go—buildPodmanRunArgsengine/docker.go— the equivalent argument builderengine/engine_test.goasserts"2337:8080", so the tests pin the current behaviourSuggestion
Bind loopback by default and make reaching it from elsewhere an explicit choice — something like
--listen 0.0.0.0at setup, stored per instance. Remote access is a reasonable thing for an administrator to want; it just should not be what happens when nobody asked.This is a default change that affects anyone already relying on remote access, which is why it is filed rather than fixed.