Repository navigation
cli: bind local backends to loopback by default - #204
Open
CloudCorpRecords wants to merge 1 commit into
Open
CloudCorpRecords wants to merge 1 commit into
CloudCorpRecords wants to merge 1 commit into
Conversation
runLocalBackend started convex-local-backend without --interface, so the binary's 0.0.0.0 default exposed the dev API and HTTP-actions ports to the whole network. Pass --interface 127.0.0.1, overridable with CONVEX_LOCAL_BACKEND_INTERFACE for machines that deliberately serve a local deployment. Fixes convex#200. Signed-off-by: Rene Turcios <95189389+CloudCorpRecords@users.noreply.github.com>
CloudCorpRecords
force-pushed
the
fix/dev-interface-200
branch
from
October 20, 2026 21:21
20e0321 to
e980a3e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #200
Root cause
runLocalBackendinsrc/cli/lib/localDeployment/run.tsbuilt the backend'scommandArgswith--port,--site-proxy-port,--instance-name, etc., but never passed--interface. The binary's default is0.0.0.0, so everyconvex devlocal deployment exposed its API port and HTTP-actions port to the whole network, even though the CLI only ever talks to the backend on127.0.0.1.The change
runLocalBackendnow passes--interface 127.0.0.1when starting the local backend (files:src/cli/lib/localDeployment/run.ts).CONVEX_LOCAL_BACKEND_INTERFACEenv var for machines that deliberately serve a local deployment to other devices, mirroring the existingCONVEX_LOCAL_BACKEND_STARTUP_TIMEOUT_SECSpattern. A blank value crashes loudly instead of silently binding to every interface.isLatestVersionsection (the repo's own compatibility pattern) so the CLI keeps working with older backend binaries that may not support--interface.Test evidence
src/cli/lib/localDeployment/run.test.ts: 3/3 passing (default is127.0.0.1, env override passes through, blank value is rejected).npx tsc --noEmit --emitDeclarationOnly false: clean, exit 0.Honest limits
convex-local-backendbinary from this environment; the fix is verified at the arg-construction and unit level. If the team prefers a--interfacecommander flag onconvex devinstead of (or in addition to) the env var, happy to switch.Signed-off-by: Rene Turcios 95189389+CloudCorpRecords@users.noreply.github.com