test(security): prove local Compose ports are loopback-bound

[seonghobae]

Scope

Test-first security work for #180 from exact protected parent develop@942d164ceb7af497bb28a95f842db96429d1bdc4.

This Draft adds only LocalComposeLoopbackBindingTest. It exercises the shipped root docker-compose.yml and requires every published host port in the default local profile to be explicitly bound to 127.0.0.1. Protected develop currently publishes all nine mappings without a host address, so the intended first hosted result is RED at that production deployment boundary.

Writer / integration boundary

Active PR #167 currently owns docker-compose.yml for the Zipkin transport repair. This branch therefore does not mutate Compose or attempt the GREEN production fix. Once #167 integrates/closes or yields a stable non-racing parent, #180 can apply the narrow loopback mappings and make this test GREEN.

Exact identity

• live base at branch creation and PR creation: 942d164ceb7af497bb28a95f842db96429d1bdc4;
• exact test-only head: 55add0bf01325e64b538cfee572278a9c42fa404;
• compare proof: one commit ahead, zero behind, merge base exactly 942d164ceb7af497bb28a95f842db96429d1bdc4;
• production files changed: none;
• Draft: true.

Acceptance boundary

The RED is valid only if hosted CI compiles the test and fails its loopback assertion against the actual bundled Compose file. Setup/import/path/fixture errors do not count. No passing check, review, or merge claim is made until exact-head evidence is refetched.

This test is a safer local-default control only. It does not claim that loopback binding substitutes for #161 service authentication, #185 registry identity, TLS, or a production deployment security profile.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6c0bb759-dfe0-4bbc-af53-18c595133dab

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}