Use host networking for compose OAuth callbacks - #5
Conversation
There was a problem hiding this comment.
Pull request overview
Updates the Docker Compose deployment path to use host networking so Chromium running inside the container can reach OAuth callback listeners bound to the host loopback interface, and aligns the documented HTTPS access behavior accordingly.
Changes:
- Switch
docker-compose.ymltonetwork_mode: hostand set the Compose defaultHATCH_HTTPS_PORTto8443. - Update README/INSTALL Compose instructions to describe host-network behavior and direct host listening.
- Update PRD acceptance criteria notes to reflect Compose host-network OAuth callback mode.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| README.md | Documents Compose host-network behavior and host-bound HTTPS port expectations. |
| PRD.md | Notes Compose host-network OAuth callback mode in acceptance criteria. |
| INSTALL.md | Updates installation guidance to reflect Compose host networking and host port binding. |
| docker-compose.yml | Enables host networking and defaults HTTPS listener port to 8443 via HATCH_HTTPS_PORT. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| ``` | ||
|
|
||
| The compose file maps host port `${HATCH_HTTPS_HOST_PORT:-8443}` to container port `${HATCH_HTTPS_PORT:-443}`. Stop it with: | ||
| The compose file uses host networking and listens on `${HATCH_HTTPS_PORT:-8443}` directly on the host. Stop it with: |
There was a problem hiding this comment.
Fixed in b44b63f: .env.example now defaults HATCH_HTTPS_PORT to 8443 for Compose host networking and removes the unused HATCH_HTTPS_HOST_PORT setting.
| ``` | ||
|
|
||
| The compose file maps host port `${HATCH_HTTPS_HOST_PORT:-8443}` to container port `${HATCH_HTTPS_PORT:-443}`. | ||
| The compose file uses host networking and listens on `${HATCH_HTTPS_PORT:-8443}` directly on the host. |
There was a problem hiding this comment.
Fixed in b44b63f: .env.example now matches the documented Compose behavior by setting HATCH_HTTPS_PORT=8443.
| - The generated Guacamole credentials are printed to container logs and usable when the container is started detached. | ||
| - Docker users can map any host port to container port `443`, for example `-p 8443:443`. | ||
| - Host-network OAuth callback mode remains documented for cases where Chromium must reach a callback listener on host loopback. | ||
| - Docker Compose uses host-network OAuth callback mode and does not rely on ignored port mappings. |
There was a problem hiding this comment.
Fixed in b44b63f: the PRD now clarifies that Compose host-network mode listens on host port 8443 by default, separate from the default image/container port behavior.
| network_mode: host | ||
| shm_size: "1gb" | ||
| environment: | ||
| RDP_USER: ${RDP_USER:-oauth} | ||
| RDP_PASSWORD: ${RDP_PASSWORD:-} | ||
| GUAC_USER: ${GUAC_USER:-} | ||
| GUAC_PASSWORD: ${GUAC_PASSWORD:-} | ||
| HATCH_HTTPS_PORT: ${HATCH_HTTPS_PORT:-443} | ||
| HATCH_HTTPS_PORT: ${HATCH_HTTPS_PORT:-8443} |
There was a problem hiding this comment.
Fixed in b44b63f: .env.example now uses HATCH_HTTPS_PORT=8443 for host networking and removes HATCH_HTTPS_HOST_PORT, which Compose no longer uses.
Summary
Validation
Operational note
The host firewall must allow inbound 8443/tcp for access outside the host network.