[Starling-spell]

Refs #1603 (the genlayer CLI compose is fixed separately in genlayer-cli#423)

What

• bind the Docker Compose PostgreSQL host port to 127.0.0.1
• keep DBHOSTPORT configurable for local tooling
• add a regression test that parses docker-compose.yml and enforces the loopback-only mapping
• also bind Redis (${REDISPORT:-6379}, no auth) and Ollama (11434) to 127.0.0.1; services reach both over the compose network

Why

The previous ${DBHOSTPORT:-5432}:5432 mapping caused Docker to publish PostgreSQL on every host interface. Combined with the development credentials, this exposed the database to unauthenticated internet attacks on publicly reachable hosts. Issue #1603 reports a real compromise that used this path to deploy a cryptominer.

The new mapping preserves host access for local development while preventing remote connections by default.

Testing done

• python -m pytest tests/unit/test_docker_compose_security.py -q: 3 passed
• full tests/unit/ over v0.123-dev@c489e7c2: 1675 passed, 7 skipped
• docker compose config validates
• git diff --check

Decisions made

• hard-code the loopback bind rather than adding an environment override, so the secure default cannot be accidentally disabled through inherited environment configuration
• retain the existing configurable host port

Checks

• I have tested this code
• I have reviewed my own PR
• I have created an issue for this PR (existing issue [CRITICAL] PostgreSQL Port Exposed to Public Internet Allows RCE and Cryptominer Deployment 🔴 #1603)
• I have set a descriptive PR title compliant with conventional commits

Reviewing tips

The functional change is the single port mapping in docker-compose.yml; the unit test protects that exact security invariant.

User facing release notes

PostgreSQL, Redis and Ollama started by GenLayer Studio's Docker Compose now listen on the local machine only by default, preventing accidental public exposure on VPS and cloud hosts.

[github-actions]

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.123-dev, the active development branch. Pushes to v0.123-dev automatically fast-forward main.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0da7c319-ba3c-43a7-9163-2f5bafff44cd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[danieljrc888]

Thanks! I refreshed the branch onto current v0.123-dev and added one commit (c0019c25) binding Redis (no auth, protected-mode off in the official image) and Ollama to 127.0.0.1 as well, with tests for both. Nothing in the stack or CI uses those host ports. I also changed Fixes #1603 to Refs #1603, since the report was against the genlayer CLI's own compose (genlayer-cli#423). tests/unit/: 1675 passed, 7 skipped.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T15:52:12.941457Z	c0019c2	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[danieljrc888]

Reviewed for the v0.123 release candidate; unit suite and CI green.

[danieljrc888]

/run-e2e all

Frozen landing cut: #1715 alone, head c0019c25540859e943ea706eb2bd7565b8d65988 over v0.123-dev@e59ddfbaa15f19a2d856f184e3e27a30c3007cb2; no cross-repository Depends-On. Full component and stack coverage (no stack selector). Native CI is green. Merge is authorized once this E2E is green.

[danieljrc888]

Landed in v0.123-dev via #1797 (squash 9e907cd), which combined #1765, #1715, #1773 and #1789 at their reviewed heads and passed full E2E. Your commits are credited with Co-authored-by. Thanks for the fix!