{"record":{"id":"a275ba2f07b9f1e1","repo":"kopia/kopia","slug":"w-hostname-q-is-not-localhost-pass-s-only-i","errorCode":null,"errorMessage":"%w: hostname %q is not localhost; pass --%s only in isolated lab environments (extremely dangerous)","messagePattern":"%w: hostname %q is not localhost; pass --(.+?) only in isolated lab environments \\(extremely dangerous\\)","errorType":"validation","errorClass":"ErrDisallowedPublicBind","httpStatus":null,"severity":"error","filePath":"internal/insecureserverbind/insecureserverbind.go","lineNumber":105,"sourceCode":"\tif host == \"\" {\n\t\treturn fmt.Errorf(\"%w: missing host in listen address %q binds all interfaces; use loopback, a unix socket, or pass --%s (extremely dangerous)\",\n\t\t\tErrDisallowedPublicBind, address, AllowDangerousUnauthenticatedNetworkFlag)\n\t}\n\n\tif strings.EqualFold(host, \"localhost\") {\n\t\treturn nil\n\t}\n\n\tif ip := net.ParseIP(host); ip != nil {\n\t\tif ip.IsLoopback() {\n\t\t\treturn nil\n\t\t}\n\n\t\treturn fmt.Errorf(\"%w: %q is not a loopback address; pass --%s only in isolated lab environments (extremely dangerous)\",\n\t\t\tErrDisallowedPublicBind, host, AllowDangerousUnauthenticatedNetworkFlag)\n\t}\n\n\treturn fmt.Errorf(\"%w: hostname %q is not localhost; pass --%s only in isolated lab environments (extremely dangerous)\",\n\t\tErrDisallowedPublicBind, host, AllowDangerousUnauthenticatedNetworkFlag)\n}\n\n// ValidateListenerAddr checks the bound listener address after Listen (covers socket activation).\nfunc ValidateListenerAddr(addr net.Addr) error {\n\tswitch a := addr.(type) {\n\tcase *net.UnixAddr:\n\t\treturn nil\n\tcase *net.TCPAddr:\n\t\tif a.IP != nil && a.IP.IsLoopback() {\n\t\t\treturn nil\n\t\t}\n\n\t\treturn fmt.Errorf(\"%w: listener %v is not loopback; pass --%s only in isolated lab environments (extremely dangerous)\",\n\t\t\tErrDisallowedPublicBind, addr, AllowDangerousUnauthenticatedNetworkFlag)\n\tdefault:\n\t\tif addr.Network() == \"unix\" {\n\t\t\treturn nil","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/kopia/kopia/blob/82495e54b584c1ef6073c9e1be048f57f8aef078/internal/insecureserverbind/insecureserverbind.go#L87-L123","documentation":"The final branch of ValidateListenAddressFlag: the host is neither empty, nor \"localhost\", nor a parseable IP, i.e. a DNS hostname other than localhost. For an unauthenticated server the validator cannot prove it is loopback-only, so it refuses with ErrDisallowedPublicBind.","triggerScenarios":"--address with a hostname such as \"myhost.local:51515\", \"kopia.example.com:51515\", or any non-localhost name while running insecure and passwordless.","commonSituations":"Using a machine's DNS name or /etc/hosts alias to listen; container hostnames; copy-pasted remote server URLs as listen addresses.","solutions":["Replace the hostname with an explicit loopback address (127.0.0.1:51515).","Use the literal hostname \"localhost\" which is explicitly accepted.","Use a unix socket address.","Configure a server password, or pass --allow-extremely-dangerous-unauthenticated-server-on-the-network in a lab environment."],"exampleFix":"// before\n--address kopia.internal:51515\n// after\n--address localhost:51515","handlingStrategy":"validation","validationCode":"host, _, _ := ParseListenHost(addr)\nif host != \"localhost\" && net.ParseIP(host) == nil {\n    return errors.New(\"use an explicit loopback IP instead of a hostname\")\n}","typeGuard":null,"tryCatchPattern":"if err := ValidateListenAddressFlag(addr); err != nil {\n    return fmt.Errorf(\"insecure server refused to start: %w\", err)\n}","preventionTips":["Use \"localhost\" literally, not machine DNS names or aliases.","Resolve hostnames to IPs yourself before configuring the listen address.","Never point a passwordless server's listen address at a routable name."],"tags":["security","server-bind","hostname"],"backgroundTag":"permission-denied","analyzedSha":"82495e54b584c1ef6073c9e1be048f57f8aef078","analyzedAt":"2026-09-07T20:35:21.689Z","contentChangedAt":"2026-09-07T20:35:21.689Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}