Requests from 127.1 should be permitted irrespective of the configurations in the "allowed clients" settings.

[metricss]

Prerequisites

• I have checked the Wiki and Discussions and found no answer

• I have searched other issues and found no duplicates

• I want to request a feature or enhancement and not ask a question

The problem

Since version 0.127.28, a health check mechanism has been implemented. Essentially, it uses queries to the server 127.0.0.1 to determine whether the service is running optimally.

However, if any configurations have been made in the "allowed clients" settings - and typically, users do not specify 127.1 - then queries from 127.1 will be rejected. Consequently, the health check would fail due to a query "timeout".

Proposed solution

Therefore, it may be more reasonable to permit queries from 127.1 irrespective of the configurations in the "allowed clients" settings. Of course, if there are any security implications, a notice could be provided to users enabling the "allowed clients" settings for their understanding and necessary actions.

Alternatives considered and additional information

No response

[pwsnla]

I don't think this is relevant anymore since healthcheck has been removed in v0.107.34. See this note in the wiki:

"Between v0.107.27 and v0.107.33, the image used Docker-provided healthcheck mechanism. It was causing many issues and has been removed in v0.107.34. See issues #5711, #5713, and discussion #5939."

[metricss]

Thanks for replying. Removing healthcheck may makes it irrelevant. But I've looked into the issues you mentioned earlier when trying to understand the problems with the healthcheck, and found that the only "solution" is to disable healthcheck.

I believe the info could assist developers in locating the root cause. Furthermore, if healthcheck was removed due to this specific issue, developers might be able to consider reinstating it. So users can monitor the service status and be possible to restart the container automatically when needed.

[ainar-g]

Thanks for the suggestion, but @pwsnla is correct, and we'd rather not add any implicit access rules, really.