From 605a4ba46e1434899b7959eee5cd1117a0b38403 Mon Sep 17 00:00:00 2001
From: Nick Stebbings <47646783+nick-stebbings@users.noreply.github.com>
Date: Mon, 9 Mar 2026 09:55:57 +1300
Subject: [PATCH] fix(docker): bind postgres to localhost only (#686)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

5432:5432 → 127.0.0.1:5432:5432 — the default docker-compose.yml
exposed postgres on all interfaces, making it reachable from the
local network in any docker compose deployment.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Zaki Manian <zaki@iqlusion.io>
---
 docker-compose.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 9b82fcdb..e3e6f578 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,7 +3,7 @@ services:
   postgres:
     image: pgvector/pgvector:pg16
     ports:
-      - "5432:5432"
+      - "127.0.0.1:5432:5432"
     environment:
       POSTGRES_DB: ironclaw
       POSTGRES_USER: ironclaw