From 382c9f49d47fa24963ea98e68e772b90e0f72fb6 Mon Sep 17 00:00:00 2001 From: Eyejoker Date: Sun, 29 Mar 2026 23:56:46 +0900 Subject: [PATCH] fix: bind credential proxy to docker0 interface on Linux Proxy was binding to 127.0.0.1 which is unreachable from Docker containers. Now uses PROXY_BIND_HOST (detects docker0 IP on Linux) so containers can reach the proxy via host.docker.internal. --- src/index.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/index.ts b/src/index.ts index 6898e95..5bc9de9 100644 --- a/src/index.ts +++ b/src/index.ts @@ -85,7 +85,7 @@ import { } from './service-routing.js'; import { FAILOVER_MIN_DURATION_MS } from './config.js'; import { startCredentialProxy } from './credential-proxy.js'; -import { cleanupOrphans } from './container-runtime.js'; +import { cleanupOrphans, PROXY_BIND_HOST } from './container-runtime.js'; // Token rotation is initialized lazily on first use or at startup below @@ -323,7 +323,7 @@ async function main(): Promise { initCodexTokenRotation(); // Start credential proxy for container isolation and clean up orphaned containers - startCredentialProxy(CREDENTIAL_PROXY_PORT).catch((err) => + startCredentialProxy(CREDENTIAL_PROXY_PORT, PROXY_BIND_HOST).catch((err) => logger.warn( { err }, 'Failed to start credential proxy (may already be running)',