feat(server): warn when listener binds loopback inside a container

[kunaldevxxx]

Which issue does this PR address?

Closes #4209

Rationale

When starting the server in a container with default settings (e.g. docker run -p 8090:8090 apache/iggy), the client-facing listener binds 127.0.0.1:8090, which only listens on the container's isolated loopback interface and is unreachable from the host.

What changed?

In validate_client_facing_address, check whether the client-facing listener binds a loopback IP inside a container. If so, emit a warning guiding the operator to set IGGY_TCP_ADDRESS=0.0.0.0:8090 together with IGGY_NODE_ADVERTISED_ADDRESS (or bind a concrete address).

Container detection inspects sentinel files (/.dockerenv, /run/.containerenv), environment variables (container, KUBERNETES_SERVICE_HOST), and Linux cgroups.

Tests were added to assert that the warning fires with the expected environment variables inside a container, does not fire outside a container, and detects container markers without reading ambient pod environments.

Local Execution

• Passed
• Pre-commit hooks ran

Ran:

• cargo fmt --all -- --check
• cargo clippy -p configs --all-features --all-targets -- -D warnings
• cargo test -p configs (270 passed, 0 failed)

AI Usage

1. Which tools?
   Antigravity AI assistant.
2. Scope of usage?
   Assisted in drafting unit test cases.
3. How did you verify the generated code works correctly?
   Ran cargo fmt, cargo clippy --all-features --all-targets -- -D warnings, and the complete configs test suite verifying all 270 tests pass.
4. Can you explain every line of the code if asked?
   Yes.

[github-actions]

Thanks for the PR. It is labeled S-waiting-on-review and queued for review.

Slash commands (own line, regular comment) move it around the queue:

• /ready - back to S-waiting-on-review after addressing feedback
• /author - flip to S-waiting-on-author while you finish changes
• /request-review @user-or-team - request a reviewer
• /pin - exempt the PR from the stale bot, /unpin to undo

See CONTRIBUTING.md for details.

[kunaldevxxx]

/request-review @hubcio

[justinmclean]

Thanks @kunaldevxxx for this PR.

I ran the validator tests on your branch and all 53 passed, so that behaviour looks to be unchanged. The warning(s) reach the log.

A few things before a more thorough review:

• Please fill in the PR template. Add Closes Warn when the server in a container listens only on loopback, and say how to recover a lost root password #4209 and complete the Local Execution and AI Usage sections. The template says PRs that don't show the code was run locally can be closed.
• The three loopback tests only check that validation returns Ok, which it already did before this change. They pass whether or not the warning fires.
• given_missing_container_indicators_when_checking_container_should_return_false still reads container and KUBERNETES_SERVICE_HOST from the real environment, so it would fail if the tests ran inside a pod. Passing those values in, as you do with the paths, would fix that.

[kunaldevxxx]

Sure @justinmclean i done please review

[codecov]

Codecov Report

❌ Patch coverage is 98.91892% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 73.81%. Comparing base (362bd78) to head (ae51e93).

Files with missing lines	Patch %	Lines
core/configs/src/server_config/validators.rs	98.91%	0 Missing and 2 partials ⚠️

Additional details and impacted files

@@              Coverage Diff              @@
##             master    #4218       +/-   ##
=============================================
- Coverage     87.48%   73.81%   -13.67%     
  Complexity     1575     1575               
=============================================
  Files          1280     1278        -2     
  Lines        223241   203672    -19569     
  Branches     186604   167036    -19568     
=============================================
- Hits         195293   150344    -44949     
- Misses        23237    48669    +25432     
+ Partials       4711     4659       -52     

Components	Coverage Δ
Rust Core	71.76% <98.91%> (-16.79%)	⬇️
Java SDK	68.68% <ø> (ø)
C# SDK	77.42% <ø> (-0.04%)	⬇️
Python SDK	90.97% <ø> (ø)
PHP SDK	85.67% <ø> (ø)
Node SDK	96.43% <ø> (-0.02%)	⬇️
Go SDK	70.14% <ø> (-0.03%)	⬇️

Files with missing lines	Coverage Δ
core/configs/src/server_config/validators.rs	94.29% <98.91%> (+1.72%)	⬆️

... and 300 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[hubcio]

nit: every test injects its own path and value, so the marker branch has no positive coverage and a typo in any indicator at 477-483 fails nothing. add one test with a real docker cgroup line.

[kunaldevxxx]

Added given_cgroup_with_docker_marker_when_checking_container_should_return_true with a real Docker cgroup entry (0::/system.slice/docker-...scope), as well as a negative test given_host_cgroup_without_markers_when_checking_container_should_return_false.

[hubcio]

two notes outside the diff.

core/server/README.md:15 is true of the repo-root Dockerfile:45-48, where docker compose up sets IGGY_*_ADDRESS=0.0.0.0. apache/iggy builds from core/server/Dockerfile, which sets no addresses and ships no config.toml, so the published image boots on the embedded default and binds 127.0.0.1 on all four listeners. the documented docker run -p 8090:8090 ... -e IGGY_NODE_ADVERTISED_ADDRESS=localhost is exactly this warning case, and it boots with a warning instead of a refusal.

dropping the advertised_address shortcut means the websocket, quic and http addresses are now parsed at validation instead of boot. both stages refuse, so a note in the commit body is enough.

[hubcio]

nit: the advice goes through warn!, so RUST_LOG=error hides it, while the 18 other operator messages in this file use eprintln!. print this one the same way.

[kunaldevxxx]

Thanks for the thorough review, @hubcio! All points have been addressed in the latest commit:

1. Loop All Enabled Client Listeners: validate_client_facing_address now loops through self.client_listeners(), so setting IGGY_TCP_ADDRESS=0.0.0.0:8090 does not silence loopback warnings for the other three listeners (websocket, quic, http).
2. Accurate Reachability Phrasing: Changed the message to "outside this network namespace", and dropped the 0.0.0.0 suggestion when node.advertised_address is set to avoid widening interfaces in host-network scenarios.
3. Environment Mapping: Used ServerConfig::find_by_config_path(listener.key) instead of string reconstruction.
4. Formatting Simplification: Built the hint string once and formatted into a single eprintln!.
5. eprintln! Alignment: Switched from warn! to eprintln! to match the rest of validators.rs.
6. Const Slice for CGroup Markers: Moved the eight marker strings to const CONTAINER_CGROUP_MARKERS: &[&str] with .iter().any().
7. Platform Gating: Gated let _ = cgroup_path; with #[cfg(not(target_os = "linux"))].
8. Test Coverage:
   • Added unit tests for positive Docker cgroup markers and negative host cgroup lines.
   • Updated unit tests to verify that all 4 loopback listeners warn by default and the remaining 3 warn when TCP is bound to 0.0.0.0:8090.

All local checks passed (cargo fmt --all -- --check, cargo clippy -p configs --all-features --all-targets -- -D warnings, and 272 tests passed in cargo test -p configs).

[hubcio]

it looks like you didn't push the changes @kunaldevxxx

[kunaldevxxx]

yes sorry it didnt got push give few min @hubcio

[kunaldevxxx]

please review now @hubcio sorry for last time

[hubcio]

CI is still failing. once you are done fixing it, please read #4218 (comment) and act accordingly - without that maintainers won't start checking this again :)

[kunaldevxxx]

/ready