From fadc53fb5043eae2fefbf515f840bed90627e579 Mon Sep 17 00:00:00 2001 From: nightcityblade Date: Wed, 15 Jul 2026 23:36:38 +0800 Subject: [PATCH] fix(docker): tolerate unavailable IPv6 loopback --- deploy/docker/supervisord.conf | 4 ++-- deploy/docker/tests/test_security_container_posture.py | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/deploy/docker/supervisord.conf b/deploy/docker/supervisord.conf index 91b4b2538..d726e2c6c 100644 --- a/deploy/docker/supervisord.conf +++ b/deploy/docker/supervisord.conf @@ -6,7 +6,7 @@ logfile_maxbytes=0 [program:redis] ; Loopback-only and password-protected. REDIS_PASSWORD is exported by ; entrypoint.sh from the mounted secret; the app must supply it to connect. -command=/usr/bin/redis-server --loglevel notice --bind 127.0.0.1 ::1 --requirepass "%(ENV_REDIS_PASSWORD)s" --dir /var/lib/redis +command=/usr/bin/redis-server --loglevel notice --bind 127.0.0.1 -::1 --requirepass "%(ENV_REDIS_PASSWORD)s" --dir /var/lib/redis user=appuser ; Run redis as our non-root user autorestart=true priority=10 @@ -31,4 +31,4 @@ stdout_logfile_maxbytes=0 stderr_logfile=/dev/stderr ; Redirect gunicorn stderr to container stderr stderr_logfile_maxbytes=0 -# Optional: Add filebeat or other logging agents here if needed \ No newline at end of file +# Optional: Add filebeat or other logging agents here if needed diff --git a/deploy/docker/tests/test_security_container_posture.py b/deploy/docker/tests/test_security_container_posture.py index 871e642de..3399d6bd1 100644 --- a/deploy/docker/tests/test_security_container_posture.py +++ b/deploy/docker/tests/test_security_container_posture.py @@ -78,8 +78,8 @@ class TestSupervisord: def test_redis_requires_password(self, supervisord): assert "--requirepass" in supervisord - def test_redis_bound_loopback(self, supervisord): - assert "--bind 127.0.0.1" in supervisord + def test_redis_bound_loopback_with_optional_ipv6(self, supervisord): + assert "--bind 127.0.0.1 -::1" in supervisord def test_gunicorn_bind_is_env_driven(self, supervisord): # entrypoint.sh resolves GUNICORN_BIND (loopback unless a credential).