feat: add WithHostIP option to bind exposed ports to a host IP - #3844
Open
shyim wants to merge 2 commits into
Open
feat: add WithHostIP option to bind exposed ports to a host IP#3844shyim wants to merge 2 commits into
shyim wants to merge 2 commits into
Conversation
By default the exposed ports of a container are bound to all host interfaces (0.0.0.0). Add a WithHostIP option and a matching HostIP field on ContainerRequest so users can restrict the port bindings to a specific IP address, e.g. localhost only. The host IP is applied to all port bindings in the pre-create hook, after the default ephemeral bindings are merged, so it covers both the default bindings and per-port bindings set via WithHostConfigModifier (overriding their HostIP while preserving their HostPort). Invalid IPs are rejected at request customization time and validated again for direct ContainerRequest users.
✅ Deploy Preview for testcontainers-go ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Summary by CodeRabbit
WalkthroughThe change adds ChangesHost IP binding
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Caller
participant WithHostIP
participant preCreateContainerHook
participant Docker
Caller->>WithHostIP: provide IP address
WithHostIP->>Caller: store canonical HostIP
Caller->>preCreateContainerHook: create container request
preCreateContainerHook->>Docker: apply HostIP to port bindings
Docker-->>Caller: expose ports on configured host IP
Possibly related PRs
Suggested labels: Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@host_ip_test.go`:
- Around line 50-54: Update the HostConfigModifier binding in the host IP
precedence test to use a different valid address, such as 0.0.0.0, while keeping
req.HostIP and its expected assertion set to 127.0.0.1. This ensures the test
verifies that req.HostIP overrides the modifier address.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 923ecec9-0182-478f-a375-7f8be5fb9d9c
📒 Files selected for processing (7)
container.godocs/features/common_functional_options.mddocs/features/common_functional_options_list.mdhost_ip_test.golifecycle.gooptions.gooptions_test.go
The precedence test used the same address (127.0.0.1) for both req.HostIP and the HostConfigModifier binding, so it passed even if the override logic was removed. Use 0.0.0.0 in the modifier binding while keeping req.HostIP and the assertion at 127.0.0.1, making the test fail when the override is absent.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds a first-class
WithHostIPoption (and a matchingHostIPfield onContainerRequest) to control the IP address to which a container's exposed ports are bound on the host.By default, testcontainers binds exposed ports to all host interfaces (
0.0.0.0). With this PR:restricts the binding to
127.0.0.1only (theWithHostConfigModifierdance is no longer needed).Implementation notes:
WithHostIP(ip string)validates the address withnetip.ParseAddrat request-customization time and stores it asreq.HostIP.preCreateContainerHookapplies the IP to all port bindings aftermergePortBindings, so it covers both the default ephemeral bindings and per-port bindings set viaWithHostConfigModifier(theHostIPis overridden while theHostPortis preserved).ContainerRequestusers get the same validation, returning an error for invalid IPs.Why is it important?
Exposing containers on
0.0.0.0is a security concern on shared/multi-tenant machines: any process on the host (or, depending on the network setup, other hosts) can reach the container. Binding to loopback was previously only possible by reaching into the internalHostConfigvia a modifier, with no validation and no documentation.My usecase is running agents on a remote host, and while testcontainer runs my postgres / and so on are publicly reachable in the Internet, without proper Firewall
Related issues