How to force che-server to bind to localhost (127.0.0.1) using CLI?

Description

I’m trying to setup Che as a local IDE on my workstation. According to the docs this scenario is supported:

This makes a single user Che a good choice for developers working locally.

The problem is that che-server binds to any local address:

tcp6       0      0 :::8080                 :::*                    LISTEN      1217/docker-proxy

So my IDE and all my workspaces are accessible without any access control to anyone in my LAN.

Reproduction Steps

• setup Che according to Getting Started: Local guide
• run sudo netstat -anp | grep 8080

OS and version:

• ubuntu 16.04
• che 5.22.0

[vsenko]

OK, the problem with localhost is that it is problematic to access 127.0.0.1 from the inside of the docker container in the default docker configuration. Why?

I managed to bind che-server to docker bridge interface (docker0) this way preventing access to it from LAN:

1. in ${data_dir}/che.env set CHE_HOST=<ip-of-the-docker0>
2. in ${data_dir}/instance/docker-compose-container.yml '8080:8080' -> '${CHE_HOST}:8080:8080'
3. start Che only with --skip:config to restrain it from rewriting ${data_dir}/instance/docker-compose-container.yml
4. Che URL is http://<ip-of-the-docker0>:8080

Anyway it bothers me that official docs encourage new users to run Local installation in such an unsafe manner.

[ghost]

https://github.com/eclipse/che/blob/69d51483859d828aa285bcef324244ca236109ad/dockerfiles/base/scripts/base/commands/cmd_stop.sh this is the script that stands behind it.

There must be some check that depends on format of port binding.