From 6d97baee7c3fbb5018de306b054627bd9a1502d0 Mon Sep 17 00:00:00 2001
From: Day Dreamer <87640074+HugoXK@users.noreply.github.com>
Date: Thu, 5 Nov 2026 02:19:05 +0800
Subject: [PATCH] docs: compose.yaml shares the host network, not a published
 port

The install invariant said compose.yaml publishes the port on 127.0.0.1, but the file has network_mode: host and no ports key; docs/docker.md already says the container shares the host network and the server binds loopback itself. Restate the invariant the way compose.yaml and docs/docker.md do.
---
 docs/subsystems/install.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/subsystems/install.md b/docs/subsystems/install.md
index 594d102e1..8871e39c6 100644
--- a/docs/subsystems/install.md
+++ b/docs/subsystems/install.md
@@ -53,7 +53,7 @@ Tooling for setup checks, the architecture-docs gate and the container image (#3
 1. Owned-file changes require a matching subsystem doc in the same PR (or a `Docs-not-needed:` trailer).
 2. Empty diff vs base passes.
 3. A new peer plugin is added to the install doctor (and its test), `check-pack.mjs`, the CI plugin matrix, `local-ci.sh` and `plugins/README.md` in the same PR. `@flybot/workflow` is one of the default commands. `@flybot/timeline` stays opt-in.
-4. The container image holds no key or token, runs as a normal user, and `compose.yaml` publishes the port on the host's `127.0.0.1` only. CI (`.github/workflows/docker.yml`) builds and start-checks it; nothing is pushed to a registry (owner decision on #352).
+4. The container image holds no key or token, runs as a normal user, and `compose.yaml` uses the host's network (`network_mode: host`) so the web server's own `127.0.0.1` bind is the only exposure — no port is published. CI (`.github/workflows/docker.yml`) builds and start-checks it; nothing is pushed to a registry (owner decision on #352).
 
 ## Tests