Multiple interface binding issue in docker

[TheFiZi]

Describe the bug
I have two networks attached to my changedetection.io container. One is used for internal communication between changedetection and sockpuppet (Internal Network), the other is for communication between changedetection and traefik (External Network)

I have LISTEN_HOST=0.0.0.0 configured but when changedetection starts it only binds to localhost and Internal Network and not External Network

 * Running on all addresses (0.0.0.0)
 * Running on http://127.0.0.1:5000
 * Running on http://[Internal Network]:5000

This results in Traefik not being able to proxy traffic into my changedetection container.

If I flip everything over to External Network and eliminate Internal Network things work as expected.

Version
v0.50.22

How did you install?
Docker

To Reproduce

Steps to reproduce the behavior:

services:
  changedetection:
    image: ghcr.io/dgtlmoon/changedetection.io
    container_name: changedetection
    hostname: changedetection
    networks:
      - priv_traefik_changedetection
      - internal
    volumes:
      - changedetection_data:/datastore
    environment:
      - PORT=5000
      - LOGGER_LEVEL=WARNING
      - PLAYWRIGHT_DRIVER_URL=ws://changedetection-sockpuppet:3000
      - BASE_URL=https://change.myfqdn.com
      - USE_X_SETTINGS=1
      - HIDE_REFERER=true
      - FETCH_WORKERS=10
      - MINIMUM_SECONDS_RECHECK_TIME=3
      - ALLOW_FILE_URI=False
      - DISABLE_VERSION_CHECK=true
      - TZ=America/Vancouver
      - LC_ALL=en_US.UTF-8
      - SCREENSHOT_MAX_HEIGHT=16000
      - LISTEN_HOST=0.0.0.0
    restart: unless-stopped
    depends_on:
      changedetection-sockpuppet:
          condition: service_started
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.change.rule=Host(`change.myfqdn.com`)"
      - "traefik.http.routers.change.entrypoints=websecure"
      - "traefik.http.routers.change.tls=true"
      - "traefik.http.routers.change.tls.certresolver=letsencrypt"
      - "traefik.http.services.change.loadbalancer.server.port=5000"
      
  changedetection-sockpuppet:
    container_name: changedetection-sockpuppet
    image: dgtlmoon/sockpuppetbrowser:latest
    # Disable to reduce risk since we're turing off Chrome Sandboxing
    #cap_add:
    #  - SYS_ADMIN
    restart: unless-stopped
    networks:
      - internal
    environment:
      - SCREEN_WIDTH=1920
      - SCREEN_HEIGHT=1024
      - SCREEN_DEPTH=16
      - MAX_CONCURRENT_CHROME_PROCESSES=10
      - TZ=America/Vancouver
      - CHROME_FLAGS=--headless --disable-gpu --no-sandbox --remote-debugging-address=0.0.0.0 --remote-debugging-port=3000 --disable-software-rasterizer --disable-dev-shm-usage --disable-extensions --disable-background-networking --disable-sync --disable-default-apps --no-first-run --no-zygote --single-process --disable-hang-monitor --disable-prompt-on-repost --mute-audio
    healthcheck:
      test: "python3 /usr/src/app/docker-health-check.py --host http://localhost"
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

volumes:
  changedetection_data:
    driver: local

networks:
  # Internal network between Traefik and ChangeDetection
  # Network is created by this stack and then Traefik attaches to it
  priv_traefik_changedetection:
    name: priv_traefik_changedetection
    driver: bridge
    external: true
  # Internal stack network so ChangeDetection can access SockPuppet
  internal:
    driver: bridge

Expected behavior
changedetection container should bind to all interfaces presented to the container

 * Running on all addresses (0.0.0.0)
 * Running on http://127.0.0.1:5000
 * Running on http://[Internal Network]:5000
 * Running on http://[External Network]:5000

Screenshots
N/A

Desktop (please complete the following information):

• OS: Windows 11
• Browser Firefox
• Version: 143.0.4

Smartphone (please complete the following information):
N/A

Additional context
N/A

[dgtlmoon]

changedetection container should bind to all interfaces presented to the container

ahh not sure about this, because the python script doesnt know its running in a container

if it was to just magically bind to all interfaces.. then that could be a security risk to people not using docker

[dgtlmoon]

If someone wanted to limit which interfaces the app binds to they could configure LISTEN_HOST=10.0.01 for example and that should do the trick.

yeah but theres already thousands of these instances out there, if i made this change, suddenly they would all start listening on interfaces that they really should NOT listen on.

[TheFiZi]

For fun I just added this to my compose:

  # Internal stack network so ChangeDetection can access SockPuppet
  internal:
    driver: bridge
  internal2:
    driver: bridge
  internal3:
    driver: bridge

and then told the container to connect to them on start-up

    networks:
      #- priv_traefik_changedetection
      - internal
      - internal2
      - internal3

When I check the container:

 * Running on all addresses (0.0.0.0)
 * Running on http://127.0.0.1:5000
 * Running on http://172.30.0.2:5000

It should be running on 2 more IPs present to the container. I am wondering if this is a bug/issue with WSGI?

[dgtlmoon]

hmm the -h according to flask and werkzeug and claude :)

        :param host: the hostname to listen on. Set this to ``'0.0.0.0'`` to
            have the server available externally as well. Defaults to
            ``'127.0.0.1'`` or the host in the ``SERVER_NAME`` config variable
            if present.

  The Key: It's an OS-Level Concept

  The special meaning of 0.0.0.0 is not implemented by Flask or Werkzeug - it's a standard behavior of the underlying socket system:

  - When you bind a socket to 0.0.0.0, the operating system knows to listen on all available IPv4 network interfaces
  - Similarly, :: means all IPv6 interfaces
  - This is standard POSIX socket behavior

if you run ifconfig or similar in the container, what do you see?

[TheFiZi]

If someone wanted to limit which interfaces the app binds to they could configure LISTEN_HOST=10.0.01 for example and that should do the trick.

yeah but theres already thousands of these instances out there, if i made this change, suddenly they would all start listening on interfaces that they really should NOT listen on.

Ah ok, maybe I'm miss understanding what LISTEN_HOST= is for.

[dgtlmoon]

LISTEN_HOST= should listen on all interfaces if set to 0.0.0.0 ...

question is, is all your interfaces and weird tricky traefik working

[dgtlmoon]

it absolutely works outside of docker...

I think its something else relating to your container or other

$ ./changedetection.py -h 0.0.0.0
...<noise>..
...

 * Running on all addresses (0.0.0.0)
 * Running on http://127.0.0.1:5000
 * Running on http://192.168.0.157:5000
Press CTRL+C to quit

ok then

$ curl http://192.168.0.157:5000
192.168.0.157 - - [13/Oct/2025 01:14:08] "GET / HTTP/1.1" 200 -
<!DOCTYPE html>
<html lang="en" data-darkmode="false">

  <head>
    <meta charset="utf-8" >
    <meta name="viewport" content="width=device-width, initial-scale=1.0" >
    <meta name="description" content="Self hosted website change detection." >

works.. http://127.0.0.1:5000 too..

something in your docker container permissions or something?

[TheFiZi]

Can you add one more IP to the host you're testing on so there are 3 total IPs for it to bind to?

I am just running a test with another stack to see if I can reproduce this problem.

[dgtlmoon]

according to claude... this is interesting, it rings a bell for some reason

The display messages are just showing you examples, not an exhaustive list.

  What's Actually Happening

  Looking at the Werkzeug code (serving.py:682-697), when it binds to 0.0.0.0, it displays:

  1. Localhost (127.0.0.1) - always shown
  2. ONE external IP - determined by calling get_interface_ip(), which uses a trick:
    - Creates a UDP socket and "connects" to an arbitrary private IP
    - The OS automatically selects which local interface it would use to reach that destination
    - That's why it shows 192.168.0.157 - that's your default route interface

[dgtlmoon]

soo it ONLY prints the interface on the default route, but it listens to everything

[dgtlmoon]

so your traefik problem is somewhere else, it IS listening on all the devices (again another weird traefik problem :)))

[TheFiZi]

Yup, I think you're right. I am re-configuring my FreshRSS stack in the same way and I am running into the same problem.

[TheFiZi]

Ah ha, got it. I needed to add this to my traefik configuration for changedetection:

- "traefik.docker.network=priv_traefik_changedetection"

So that way traefik explicitly knew which network it should be using.

[TheFiZi]

Resolved. User error and some truncated output from WSGI 😄