Initial Meterbox commit with boot disk usage metric.

Co-authored-by: Cursor <cursoragent@cursor.com>

.cursor/rules/docker-always-localhost.mdc

@@ -0,0 +1,13 @@
+---
+description: Meterbox always runs via Docker with localhost-only exposure
+alwaysApply: true
+---
+
+# Meterbox runtime
+
+- **Always Dockerize** Meterbox. Do not run the native binary as the supported deploy path.
+- **Localhost only.** Never publish as `8787:8787` or `0.0.0.0:8787`.
+- Preferred compose mode: `network_mode: host` with `METERBOX_LISTEN=127.0.0.1:8787` (no Docker port publish, no DNAT bypass).
+- If bridge networking is used instead, publish only `127.0.0.1:8787:8787`.
+- After Docker changes: `sudo iptables -L -n -v` and confirm `DOCKER*` chains coexist with the Oracle firewall.
+- Caddy/Rathole proxy to `127.0.0.1:8787`; Internet clients must not reach the container directly.

.cursor/rules/docker-localhost-ports.mdc

@@ -0,0 +1,44 @@
+---
+description: Docker published ports must bind to localhost only on this Oracle host (iptables/Caddy/Rathole)
+alwaysApply: true
+---
+
+# Docker + iptables: localhost-only publishes
+
+Docker modifies iptables and creates chains such as `DOCKER`, `DOCKER-FORWARD`, and `DOCKER-USER`. Published container ports can bypass some host-firewall assumptions.
+
+Do **not** assume:
+
+```bash
+docker run -p 8080:8080 ...
+```
+
+is protected by the host `INPUT REJECT` the way an ordinary host process is. Oracle firewall rules remain, but Docker port publishing is a different path.
+
+## Hard rule
+
+Bind **all** Docker published ports to localhost unless the user explicitly requests public exposure:
+
+```bash
+# Required default
+docker run -p 127.0.0.1:8080:8080 ...
+
+# Do not use by default
+docker run -p 8080:8080 ...
+```
+
+Compose equivalent:
+
+```yaml
+ports:
+  - "127.0.0.1:8080:8080"
+```
+
+Caddy/Rathole can reach localhost; Internet clients must not hit containers directly. Public ingress stays on intentionally opened host ports (80/443, Rathole, etc.).
+
+## Checklist
+
+- Before adding containers with published ports: `sudo iptables -L -n -v`
+- Confirm `DOCKER*` chains coexist with the Oracle firewall
+- Prefer `DOCKER-USER` for extra Docker firewall policy
+- Never publish `0.0.0.0:PORT` / bare `-p HOST:CONTAINER` without explicit user approval