alex/headquarter
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(cloudflared): use --bind-addr with port for code-server bind fix

Browse Source 
Root cause: _ensure_web_bind_address injected --host 0.0.0.0 for code-server,
which only sets the bind host, not the port. code-server then listens on its
default port (8080) instead of the tool type's default_port (8443). Cloudflared
connects to port 8443 and gets connection refused, resulting in a 502.

Changes:
- _ensure_web_bind_address now accepts default_port and builds
  --bind-addr 0.0.0.0:{port} for code-server
- Same fix for jupyter-notebook with explicit --port flag
- Existing broken --host commands are now detected and replaced
- New migration fixes tool_types templates and instance compose files on disk
- Test fixture updated to use correct --bind-addr 0.0.0.0:8443
This commit is contained in:
Developer
2026-05-29 16:49:52 +00:00
parent aa25852091
commit 6bd814e346
3 changed files with 173 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/api/tool_instances.py
+24 -11
View File
@@ -652,7 +652,9 @@ def _ensure_container_name_in_compose(compose_path: str, container_name: str) ->
)
def _ensure_web_bind_address(compose_path: str, tool_type_name: str) -> None:
def _ensure_web_bind_address(
compose_path: str, tool_type_name: str, default_port: int
) -> None:
"""Auto-inject bind address for known web tools that default to 127.0.0.1.
Many web tools (code-server, jupyter) bind to localhost by default,
@@ -662,9 +664,12 @@ def _ensure_web_bind_address(compose_path: str, tool_type_name: str) -> None:
import yaml
from pathlib import Path
KNOWN_BIND_FIXES = {
"code-server": "--host 0.0.0.0",
"jupyter-notebook": "start-notebook.sh --ip=0.0.0.0",
if default_port <= 0:
return
KNOWN_BIND_FIXES: dict[str, str] = {
"code-server": f"--bind-addr 0.0.0.0:{default_port}",
"jupyter-notebook": f"start-notebook.sh --ip=0.0.0.0 --port={default_port} --no-browser",
}
bind_command = KNOWN_BIND_FIXES.get(tool_type_name)
@@ -713,8 +718,15 @@ def _ensure_web_bind_address(compose_path: str, tool_type_name: str) -> None:
existing_command = service_config.get("command", "")
if existing_command:
# Fix broken --bind-addr (replaces with --host)
if "--bind-addr" in existing_command:
# Already correct — nothing to do
if bind_command in existing_command:
return
# Fix broken or outdated bind flags
if (
"--bind-addr" in existing_command
or "--host" in existing_command
or "--ip=" in existing_command
):
service_config["command"] = bind_command
compose_file.write_text(
yaml.dump(compose_data, default_flow_style=False)
@@ -726,9 +738,6 @@ def _ensure_web_bind_address(compose_path: str, tool_type_name: str) -> None:
bind_command,
)
return
# Already has correct --host, nothing to do
if "--host" in existing_command or "--ip=" in existing_command:
return
# Some other command override exists — don't touch it
return
@@ -1673,7 +1682,9 @@ async def start_instance(
# Auto-fix bind address for known web tools that default to localhost
if tool_type and tool_type.interface_type == "web":
_ensure_web_bind_address(instance.compose_path, tool_type.name)
_ensure_web_bind_address(
instance.compose_path, tool_type.name, tool_type.default_port
)
# Ensure predictable container name for tunnel connectivity
_ensure_container_name_in_compose(instance.compose_path, instance.name)
@@ -2151,7 +2162,9 @@ async def restart_instance(
_sanitize_compose_file(instance.compose_path)
tool_type = await session.get(ToolType, instance.tool_type_id)
if tool_type and tool_type.interface_type == "web":
_ensure_web_bind_address(instance.compose_path, tool_type.name)
_ensure_web_bind_address(
instance.compose_path, tool_type.name, tool_type.default_port
)
_ensure_container_name_in_compose(instance.compose_path, instance.name)
returncode, stdout, stderr = execute_compose_command(