Sandboxes: published ports now default to IPv4 - #25868
Draft
robmry wants to merge 1 commit into
Draft
Conversation
Docker Sandboxes 0.39 publishes a port on IPv4 only when no protocol is named, where it previously bound both address families. That removes a dead end: a dual-stack binding forwarded a host connection arriving on ::1 to the sandbox's IPv6 address, where a service listening only on IPv4 never answered, and the connection was accepted and then reset — which no client recovers from, unlike a refusal. Three pages described the old behaviour: - the kit reference said an empty `protocol` meant `tcp`, and its example spelled out `protocol: tcp`, which now opts a kit out of the default and back into the dead end; - the workflows guide told readers to work around dual-stack publishing by pinning `/tcp4` themselves; - both the workflows and usage pages showed `sbx ls` reporting `/tcp` for a defaulted publish.
✅ Deploy Preview for docsdocker ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Docker Sandboxes 0.39 publishes a port on IPv4 only when no protocol is named, where it previously bound both address families (docker/sandboxes#4994, reported as docker/sbx-releases#342). Three pages still describe the old behaviour, and one of them recommends a pattern that now works against the fix.
customize/kit-reference.mdsaid an emptyprotocolmeanstcp, and its example spelled outprotocol: tcp. Both are now misleading: omitting the field publishes IPv4 only, which is what a service bound to0.0.0.0needs, whiletcppublishes both families and needs the service listening on IPv6 too. A kit copying the old example opts itself out of the new default — that is exactly what happened to thecode-serverkit (docker/sbx-kits-contrib#208). The field table now points at prose that explains both choices, and the example omits the field.workflows.mdtold readers to work around dual-stack publishing themselves ("pin the published port to one family with--publish 8080:3000/tcp4"). The default now does that for them, so the paragraph explains what the default gives you and what namingtcpor/tcp6requires instead.workflows.mdandusage.mdboth showedsbx lsreporting127.0.0.1:8080->3000/tcpfor a defaulted publish. It now reports/tcp4.The CLI reference at
data/sbx_cli/sbx_ports.yamlis generated from the sandboxes repo and already carries the new help text, so it needs a sync rather than an edit here.ai/sandboxes/release-notes.mdis generated too, and picks the change up from the release's own notes.Related issues or tickets
code-serverkit, which pinnedprotocol: tcpand so kept the old dead endReviews
🤖 Raised by Claude Code on behalf of @robmry.