---
description: Meterbox always runs via Docker with localhost-only exposure
alwaysApply: true
---

# Meterbox runtime

- **Always Dockerize** Meterbox. Do not run the native binary as the supported deploy path.
- **Localhost only.** Never publish as `8787:8787` or `0.0.0.0:8787`.
- Preferred compose mode: `network_mode: host` with `METERBOX_LISTEN=127.0.0.1:8787` (no Docker port publish, no DNAT bypass).
- If bridge networking is used instead, publish only `127.0.0.1:8787:8787`.
- After Docker changes: `sudo iptables -L -n -v` and confirm `DOCKER*` chains coexist with the Oracle firewall.
- Caddy/Rathole proxy to `127.0.0.1:8787`; Internet clients must not reach the container directly.