docker-compose.yml exposes FlareSolverr on all interfaces by default

Have you checked our README?

• I have checked the README

Have you followed our Troubleshooting?

• I have followed your Troubleshooting

Is there already an issue for your problem?

• I have checked older issues, open and closed

Have you checked the discussions?

• I have read the Discussions

Have you ACTUALLY checked all these?

YES

Environment

- FlareSolverr version: master at 0f05ed8fc974b215c36892b5a30122e27fe3c671
- Last working FlareSolverr version: unknown
- Operating system: Ubuntu 24.04 (remote deployment inspection)
- Are you using Docker: yes
- FlareSolverr User-Agent (see log traces or / endpoint): not applicable
- Are you using a VPN: no
- Are you using a Proxy: no
- URL to test this issue: Docker Compose default deployment

Description

Description

The README warns that FlareSolverr must not be exposed to the public internet and the Docker command example binds the service to localhost. The Compose file instead publishes the configured port without a host IP address, which Docker binds to all host interfaces by default. A standard compose deployment therefore creates an externally reachable API on hosts with permissive firewall rules.

Expected behaviour

The provided Compose configuration should be safe by default and require an explicit opt-in for broader exposure.

Proposed fix

Use a configurable PORT_BIND variable with a 127.0.0.1 default in docker-compose.yml and document how operators can override it intentionally. A deployment inspection confirms the current service itself is loopback-bound; the issue is the repository's Compose default.

Logged Error Messages

No application error is required; Docker reports a 0.0.0.0 port mapping for the current Compose syntax.

Screenshots

No response