fix(compose): bind standalone ports to loopback - #91
Conversation
📝 WalkthroughWalkthroughStandalone Compose의 PostgreSQL 및 컴포넌트 포트를 IPv4 loopback에 게시합니다. 포트 게시 계약 테스트와 배포 정책 문서, README 및 변경 기록을 추가했습니다. ChangesCompose loopback 게시
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/test_compose_network_boundary.py`:
- Around line 12-19: Update
test_standalone_compose_publishes_database_and_health_only_on_loopback to parse
the Compose configuration rather than searching raw text. Validate the parsed
postgres.ports and component.ports values contain exactly the permitted
127.0.0.1 loopback mappings for ports 5432 and 8080, rejecting any 0.0.0.0,
[::], or other published mappings.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 5550596b-a7cb-40b7-a34f-4704cfd18cf7
📒 Files selected for processing (5)
CHANGELOG.mdREADME.mddocker-compose.ymldocs/doctoring/compose-loopback-publishing.mdtests/test_compose_network_boundary.py
|
@coderabbitai review |
Rate Limit Exceeded
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head8e084be4d3504f6abe2dca75c859a2a9b0e04753. -
Head SHA:
8e084be4d3504f6abe2dca75c859a2a9b0e04753 -
Workflow run: 31318273608
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (3 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (3 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: compose-loopback-publishing.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: compose-loopback-publishing.md"]
R2 --> V2["docs review"]
Evidence --> S3["Test: test_compose_network_boundary.py"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test: test_compose_network_boundary.py"]
R3 --> V3["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage evidence job did not run or did not publish coverage evidence. Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (3 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (3 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: compose-loopback-publishing.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: compose-loopback-publishing.md"]
R2 --> V2["docs review"]
Evidence --> S3["Test: test_compose_network_boundary.py"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test: test_compose_network_boundary.py"]
R3 --> V3["targeted test run"]
|
|
@coderabbitai review |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/test_compose_network_boundary.py`:
- Around line 63-66: Update _assert_standalone_port_contract to iterate over
every service in model["services"], preserving the existing loopback checks for
postgres and component while raising AssertionError when any other service has a
non-empty ports collection.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 5e2a0049-79d3-4fd6-bf0b-64b064d7ec88
📒 Files selected for processing (1)
tests/test_compose_network_boundary.py
|
@coderabbitai review |
|
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head085d672aaff668980a0be3e5965fa57080bc10c0. -
Head SHA:
085d672aaff668980a0be3e5965fa57080bc10c0 -
Workflow run: 31333595955
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (3 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (3 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: compose-loopback-publishing.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: compose-loopback-publishing.md"]
R2 --> V2["docs review"]
Evidence --> S3["Test: test_compose_network_boundary.py"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test: test_compose_network_boundary.py"]
R3 --> V3["targeted test run"]
|
@coderabbitai review Please review exact current source head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
target='085d672aaff668980a0be3e5965fa57080bc10c0'
echo '== Checked-out commit =='
git rev-parse HEAD
git cat-file -e "${target}^{commit}"
git diff-tree --no-commit-id --name-status -r "$target"
echo
echo '== Compose file at target =='
git show "${target}:docker-compose.yml" | nl -ba
echo
echo '== Test file map =='
ast-grep outline tests/test_compose_network_boundary.py --items all --view expanded || true
echo
echo '== Test file at target =='
git show "${target}:tests/test_compose_network_boundary.py" | nl -ba
echo
echo '== Relevant documentation references =='
git show "${target}:README.md" | rg -n -C2 '127\.0\.0\.1|Compose|loopback|5432|8080' || true
git show "${target}:docs/doctoring/compose-loopback-publishing.md" | nl -baLength of output: 1255 🏁 Script executed: #!/bin/bash
set -euo pipefail
target='085d672aaff668980a0be3e5965fa57080bc10c0'
number() { awk '{printf "%6d\t%s\n", NR, $0}'; }
echo '== Target commit diff =='
git show --format=fuller --stat --find-renames "$target"
git diff "${target}^" "$target" -- docker-compose.yml tests/test_compose_network_boundary.py
echo
echo '== docker-compose.yml at target =='
git show "${target}:docker-compose.yml" | number
echo
echo '== tests/test_compose_network_boundary.py at target =='
git show "${target}:tests/test_compose_network_boundary.py" | number
echo
echo '== All tracked Compose-related files at target =='
git ls-tree -r --name-only "$target" | grep -Ei '(^|/)(docker-?compose|compose)[^/]*\.(ya?ml|json)$|\.env(\.|$)' || true
echo
echo '== References to Compose files or port publication in target =='
git grep -n -E 'docker-compose\.yml|compose.*(-f|file)|published|ports:|5432|8080' "$target" -- \
':!README.md' ':!docs/doctoring/compose-loopback-publishing.md' || true
echo
echo '== Working-tree test difference (informational; not reviewed) =='
git diff -- tests/test_compose_network_boundary.py || trueLength of output: 16955
No source findings in the requested scope.
The sandbox could not run Docker Compose. This review therefore verifies the exact source and test logic statically. I treated the OpenCode coverage-evidence failure as a merge-readiness infrastructure blocker, not a source finding.
|
|
@coderabbitai review Please review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
target='085d672aaff668980a0be3e5965fa57080bc10c0'
echo '== Commit identity =='
git rev-parse HEAD
git cat-file -e "${target}^{commit}"
git show -s --format='%H%n%P%n%s' "$target"
echo
echo '== Files changed by target =='
git diff-tree --no-commit-id --name-status -r "$target"
echo
echo '== Compose inputs at target =='
git ls-tree -r --name-only "$target" |
rg '(^|/)(docker-?compose|compose)[^/]*\.(ya?ml|json)$|(^|/)\.env(\.[^/]+)?$' || true
echo
echo '== docker-compose.yml at target =='
git show "${target}:docker-compose.yml" | nl -ba
echo
echo '== Test structure =='
git show "${target}:tests/test_compose_network_boundary.py" > /tmp/test_compose_network_boundary.py
ast-grep outline /tmp/test_compose_network_boundary.py --items all --view expanded || true
echo
echo '== Compose boundary test at target =='
nl -ba /tmp/test_compose_network_boundary.py
echo
echo '== Current target references to Compose port publication =='
git grep -n -E 'ports:|published:|target:|host_ip:|127\.0\.0\.1|5432|8080|docker-compose\.yml' "$target" -- \
':!README.md' ':!docs/doctoring/compose-loopback-publishing.md' || trueLength of output: 1863 🏁 Script executed: #!/bin/bash
set -euo pipefail
target='085d672aaff668980a0be3e5965fa57080bc10c0'
number_lines() { awk '{printf "%6d %s\n", NR, $0}'; }
echo '== docker-compose.yml at target =='
git show "${target}:docker-compose.yml" | number_lines
echo
echo '== Boundary test at target =='
git show "${target}:tests/test_compose_network_boundary.py" | number_lines
echo
echo '== Boundary test symbols =='
git show "${target}:tests/test_compose_network_boundary.py" > /tmp/test_compose_network_boundary.py
if command -v ast-grep >/dev/null 2>&1; then
ast-grep outline /tmp/test_compose_network_boundary.py --items all --view expanded
else
awk '/^(def |class |[[:space:]]+def )/ {printf "%6d %s\n", NR, $0}' /tmp/test_compose_network_boundary.py
fi
echo
echo '== All target references relevant to Compose model parsing and assertions =='
git grep -n -E 'docker compose|compose config|--format|json|services|ports|published|host_ip|protocol|127\.0\.0\.1|5432|8080' \
"$target" -- ':!README.md' ':!docs/doctoring/compose-loopback-publishing.md' || trueLength of output: 53639
No source findings in the requested scope.
The current regression test uses the normalized Docker Compose JSON model. It iterates all services and requires the host-published service set to equal The added negative test verifies that a third service with a host-published port fails the contract. This covers the complete published-service allow-list requirement. I reviewed current-head source only. I did not run Docker Compose in this inspection.
|
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
@coderabbitai review Please review the unchanged exact source head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
target='085d672aaff668980a0be3e5965fa57080bc10c0'
echo '== Commit identity =='
git rev-parse HEAD
git cat-file -e "${target}^{commit}"
git show -s --format='%H%n%P%n%s' "$target"
echo
echo '== Compose inputs at target =='
git ls-tree -r --name-only "$target" |
rg '(^|/)(docker-?compose|compose)[^/]*\.(ya?ml|json)$|(^|/)\.env(\.[^/]+)?$' || true
echo
echo '== docker-compose.yml at target =='
git show "${target}:docker-compose.yml" | nl -ba
echo
echo '== Boundary-test structure =='
git show "${target}:tests/test_compose_network_boundary.py" > /tmp/test_compose_network_boundary.py
ast-grep outline /tmp/test_compose_network_boundary.py --items all --view expanded || true
echo
echo '== Boundary test at target =='
nl -ba /tmp/test_compose_network_boundary.py
echo
echo '== Relevant target references outside documentation =='
git grep -n -E 'ports:|published:|target:|host_ip:|127\.0\.0\.1|5432|8080|docker-compose\.yml' \
"$target" -- ':!README.md' ':!docs/doctoring/compose-loopback-publishing.md' || trueLength of output: 1688 🏁 Script executed: #!/bin/bash
set -euo pipefail
target='085d672aaff668980a0be3e5965fa57080bc10c0'
number_lines() { awk '{printf "%6d %s\n", NR, $0}'; }
echo '== docker-compose.yml at target =='
git show "${target}:docker-compose.yml" | number_lines
echo
echo '== tests/test_compose_network_boundary.py at target =='
git show "${target}:tests/test_compose_network_boundary.py" | number_lines
echo
echo '== Function and class declarations in the boundary test =='
git show "${target}:tests/test_compose_network_boundary.py" |
awk '/^(def |class |[[:space:]]+def )/ {printf "%6d %s\n", NR, $0}'
echo
echo '== All target host-publication declarations outside documentation =='
git grep -n -E '^[[:space:]]*ports:|published:|target:|host_ip:|protocol:|127\.0\.0\.1|5432|8080' \
"$target" -- ':!README.md' ':!docs/doctoring/compose-loopback-publishing.md' || trueLength of output: 12942
No source findings in the requested scope.
I did not run Docker Compose in this source inspection. I excluded the known central OpenCode coverage-evidence bootstrap failure from source findings, as requested.
|
|
@coderabbitai review Please review exact current head |
|
I will focus on the normalized Compose-model allow-list and the Docker Compose port-boundary regression. I will treat predecessor-head findings as historical.
|
2 participants
Superseded
Closed unmerged because protected-main PR #138 (
fix(compose): rebuild loopback publishing on current main) rebuilt this security slice on the current protected line and was merged atb7f8a48d4745ebd1b429027168c3d2f776c6a4a7.The protected result preserves the material intent of this branch: PostgreSQL and component health publish only on IPv4 loopback in the bundled standalone Compose profile, the complete host-published service set is allow-listed, the obsolete shell-era
PG_LLM_BATCH_HEALTH_PORToverride is absent, the Compose model is validated structurally, and operator doctoring records the explicit-ingress boundary. Current main also contains later unrelated security/reliability work that this stale branch does not.No checks, reviews, or approvals from this closed branch are transferred to #138 or protected main. The authoritative acceptance evidence is the exact-head evidence collected on #138 before its protected merge.