From afeddfced13440ab1cad648757b1fcaaa1cece2f Mon Sep 17 00:00:00 2001 From: atlas Date: Fri, 17 Jul 2026 01:08:42 +0200 Subject: [PATCH] docs(#1977): drop exposeHostPorts proxy history from network.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Trim the historical parenthetical about the dropped systemd-socket-proxyd forwarder — argus flagged it (🟡 on the merged PR) and the constraint (bind 0.0.0.0 or the bridge IP, not loopback) stands on its own without the "why we dropped the proxy" narrative. No-history-in-docs preference. --- docs/network.md | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/docs/network.md b/docs/network.md index 40128d26..aa183df8 100644 --- a/docs/network.md +++ b/docs/network.md @@ -171,10 +171,7 @@ This is **firewall-only**: the host service must bind an address reachable from the bridge — `0.0.0.0` or the bridge IP — not loopback only. The bridge→`127.0.0.0/8` DROP rule (below) is unchanged, so a service bound to `127.0.0.1` only stays unreachable; rebind it to -`0.0.0.0`. (An earlier revision shipped a per-port -`systemd-socket-proxyd` bridge→loopback forwarder, but that collides -EADDRINUSE with any collector already bound to `0.0.0.0` — which is the -common case — so the proxy was dropped in favour of opening the port.) +`0.0.0.0`. The port is reachable by **every** agent on the bridge subnet (like DNS/gateway), so only expose services safe for any agent to reach.