# Suggestion for getting started page, bind to container to localhost **URL:** \ **Category:** General Feedback\ **Created:** [June 14, 2022, 6:27pm UTC](https://forum.opensearch.org/t/suggestion-for-getting-started-page-bind-to-container-to-localhost/9928 "2022-06-14T18:27:49Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![tallison](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/tallison/32/2686_2.png) [@tallison](https://forum.opensearch.org/u/tallison)\ **Post date:** [June 14, 2022, 6:27pm UTC](https://forum.opensearch.org/t/suggestion-for-getting-started-page-bind-to-container-to-localhost/9928/1 "2022-06-14T18:27:49Z")
On this page: [Docker - OpenSearch documentation](https://opensearch.org/docs/latest/opensearch/install/docker/) I think it might be better to warn people to bind the docker container to localhost. It may be a surprise to some new to docker that this instance is available to the web by default. Suggested change from: ```auto docker run -p 9200:9200 -p 9600:9600 -e "discovery.type=single-node" opensearchproject/opensearch:2.0.0 ``` to ```auto docker run -p 127.0.0.1:9200:9200 -p 127.0.0.1:9600:9600 -e "discovery.type=single-node" opensearchproject/opensearch:2.0.0 ``` ---
**Author:** ![dtaivpp](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/dtaivpp/32/2814_2.png) [@dtaivpp](https://forum.opensearch.org/u/dtaivpp)\ **Post date:** [June 14, 2022, 8:44pm UTC](https://forum.opensearch.org/t/suggestion-for-getting-started-page-bind-to-container-to-localhost/9928/2 "2022-06-14T20:44:14Z")
Hey Tim! I think this is a really good call out. If you want to put in an Issue/PR I think it would be well received. It’s open for contributions here 😊 > ---
**Author:** ![tallison](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/tallison/32/2686_2.png) [@tallison](https://forum.opensearch.org/u/tallison)\ **Post date:** [March 1, 2023, 7:39pm UTC](https://forum.opensearch.org/t/suggestion-for-getting-started-page-bind-to-container-to-localhost/9928/3 "2023-03-01T19:39:04Z")
Only 7 months later… > > > \*\*What do you want to do?\*\* > > \- \[\*\] Request a change to existing documentation… > \- \[\] Add new documentation > \- \[\] Report a technical problem with the documentation > \- \[\] Other > > \*\*Tell us about your request.\*\* Provide a summary of the request and all versions that are affected. > Docker does some, um, interesting things with iptables by default. > > If you run your demo commandline \`docker run -d -p 9200:9200 -p 9600:9600 -e "discovery.type=single-node" opensearchproject/opensearch:latest\` on a linux server that is not air-gapped from the internet, this instance will be open to the internet even though a docker-naive junior admin may say, "but we locked down those ports!" > > That admin is correct about actions they took. > > However, Docker may overwrite those protections unless the users have disabled Docker's default behavior: \`iptables=false\`or modifying the \`daemon.json\` file. > > To fix this vulnerability, include a bind to localhost in your examples. > > \`docker run -d -p 127.0.0.1:9200:9200 -p 127.0.0.1:9600:9600 -e "discovery.type=single-node" opensearchproject/opensearch:latest\` > > \*\*What other resources are available?\*\* Provide links to related issues, POCs, steps for testing, etc. > We did this over on Tika: https://hub.docker.com/r/apache/tika with an explanatory note about binding to localhost. > > Ref: > https://stackoverflow.com/questions/64081992/docker-opened-up-ports-to-public-how-do-i-close-them > https://serverfault.com/questions/1077849/why-is-firewalld-allowing-public-traffic-to-my-non-public-ports-bound-to-docker > > Note that even this binding might not be enough! > https://www.jeffgeerling.com/blog/2020/be-careful-docker-might-be-exposing-ports-world I really like that there’s a link on the page for opening an issue on the documentation! Thank you!