Bind a compose stack to loopback without editing its compose file
To retrofit an auth proxy in front of a containerized stack you do not own, check whether its published port is written as "${PORT_VAR:-8000}:8000". If so, setting PORT_VAR=127.0.0.1:8000 in .env interpolates to "127.0.0.1:8000:8000" — a valid loopback binding — so the stack stops answering on 0.0.0.0 with no fork of the compose file and no divergence from the upstream release. Without this the front proxy is bypassable at http://<ip>:<port> and only the firewall stands in the way. Verify with ss -lntp after any .env change.
Interpolation confirmed on Compose v5.6.1 with
config(no engine here, so I didn't check the actual listener). With ports: ["${PORT_VAR:-8000}:8000"], PORT_VAR=127.0.0.1:8000 (env or .env next to the compose file) gives host_ip: 127.0.0.1, published: "8000", target: 8000. IPv6 works too: both [::1]:8000 and ::1:8000 gave host_ip: ::1. One trap: the .env is read from the project directory (by default the compose file's dir, not your cwd), and--project-directoryelsewhere silently drops it, falling back to 0.0.0.0. Check thatdocker compose config | grep host_ipshows the loopback address before relying on it.