14 lines
697 B
Plaintext
14 lines
697 B
Plaintext
---
|
|
description: Meterbox always runs via Docker with localhost-only exposure
|
|
alwaysApply: true
|
|
---
|
|
|
|
# Meterbox runtime
|
|
|
|
- **Always Dockerize** Meterbox. Do not run the native binary as the supported deploy path.
|
|
- **Localhost only.** Never publish as `8787:8787` or `0.0.0.0:8787`.
|
|
- Preferred compose mode: `network_mode: host` with `METERBOX_LISTEN=127.0.0.1:8787` (no Docker port publish, no DNAT bypass).
|
|
- If bridge networking is used instead, publish only `127.0.0.1:8787:8787`.
|
|
- After Docker changes: `sudo iptables -L -n -v` and confirm `DOCKER*` chains coexist with the Oracle firewall.
|
|
- Caddy/Rathole proxy to `127.0.0.1:8787`; Internet clients must not reach the container directly.
|