[Bug]: openhands serve binds to 0.0.0.0 by default.

[Matir]

Is there an existing issue for the same bug?

• I have searched existing issues and this is not a duplicate.

Bug Description

Running openhands serve starts the webui in a docker container bound to 0.0.0.0. If this is done on an internet-facing device, openhands is exposed to the internet.

Expected Behavior

It binds to localhost by default.

Actual Behavior

It binds to 0.0.0.0

Steps to Reproduce

1. Run openhands serve
2. Visit :3000 from another host

OpenHands CLI Installation Method

CLI (uv tool install)

If you selected "Other", please specify

No response

OpenHands CLI Version

OpenHands CLI 1.15.0

Version Confirmation

• I have confirmed this bug exists on the LATEST version of OpenHands CLI

Model Name

No response

Operating System

Linux

Terminal / Shell

No response

Logs and Error Messages

No response

Screenshots and Additional Context

No response

[vandit98]

Hi, Vandit here. I’m taking a look at this and will open a focused PR if the default bind address change validates cleanly.

[github-actions]

This issue is stale because it has been open for 40 days with no activity. Remove the stale label or leave a comment, otherwise it will be closed in 10 days.