SSH server port published on 0.0.0.0 — claude:claude reachable from the LAN

[alanbem]

Problem

Two exposure paths for the password-auth SSH server (claude:claude):

1. Bridge mode: -p "${ssh_port}:${ssh_port}" (dclaude:1878) binds 0.0.0.0 by Docker default — once dclaude ssh server starts sshd, anyone on the local network can log in
2. Host mode: sshd listens directly on the host network stack, same LAN exposure

The container user is in the docker group with the host Docker socket mounted, so an SSH login is effectively host-level control (can start privileged containers, mount host paths). SECURITY.md's "local development only" note undersells this: coffee-shop / office LAN is enough.

Fix

• Bridge mode: bind loopback only — -p "127.0.0.1:${ssh_port}:${ssh_port}". All documented use cases (JetBrains Gateway, VS Code Remote, sftp) connect to localhost, so nothing breaks
• Host mode: pass an sshd ListenAddress 127.0.0.1 (e.g. /usr/sbin/sshd -p $port -o ListenAddress=127.0.0.1 in cmd_ssh_server)
• Longer term: generate a per-container random password or use key auth, since the hardcoded credential is guessable by anyone who reads the repo

---

Found during a full-project code review.