diff --git a/Docker-AIO/.env.prod.seaweedfs.example b/Docker-AIO/.env.prod.seaweedfs.example
index 3b58b57..af81a53 100644
--- a/Docker-AIO/.env.prod.seaweedfs.example
+++ b/Docker-AIO/.env.prod.seaweedfs.example
@@ -91,11 +91,8 @@ PB_S3_BUCKET=drivervault
 # It is mounted at /seaweed/data, the layout `weed server -dir` writes — the
 # same one the .split. files use, so the two are interchangeable on it.
 SEAWEED_DATA=seaweed_data
-# The S3 port is published on loopback only — PocketBase reaches the gateway
-# inside the container, and this is for tools like aws-cli. Set
-# SEAWEED_S3_BIND=0.0.0.0 to expose it to other hosts, and mean it.
-# SEAWEED_S3_BIND=127.0.0.1
-# SEAWEED_S3_PORT=8333
+# The S3 gateway publishes no host port: PocketBase reaches it inside the
+# container.
 
 # Existing uploads are NOT migrated when this is switched on: PocketBase copies
 # nothing, so attachments made before the switch stop resolving. Read the file
diff --git a/Docker-AIO/.env.prod.seaweedfs.split.example b/Docker-AIO/.env.prod.seaweedfs.split.example
index 7ef5de8..4f710ba 100644
--- a/Docker-AIO/.env.prod.seaweedfs.split.example
+++ b/Docker-AIO/.env.prod.seaweedfs.split.example
@@ -97,14 +97,9 @@ PB_S3_BUCKET=drivervault
 # docker-compose.prod.seaweedfs.yml are interchangeable on the same volume, with
 # nothing to migrate either way.
 SEAWEED_DATA=seaweed_data
-# The S3 port is published on loopback only — PocketBase reaches the gateway
-# inside the container, and this is for tools like aws-cli. Set
-# SEAWEED_S3_BIND=0.0.0.0 to expose it to other hosts, and mean it.
-# SEAWEED_S3_BIND=127.0.0.1
-# SEAWEED_S3_PORT=8333
-#
-# The master, volume and filer listen on the container's loopback and publish
-# no host port at all. The admin UI below shows what they would: the volume
+# The S3 gateway publishes no host port: PocketBase reaches it inside the
+# container. The master, volume and filer listen on the container's loopback
+# and publish no host port at all. The admin UI below shows what they would: the volume
 # server in particular serves file content by id with no authentication. Reach
 # them with `docker compose exec drivervault wget -qO- http://127.0.0.1:9333/...`
 # (volume 8081, filer 8888).
@@ -123,7 +118,7 @@ SEAWEED_ADMIN_PASSWORD=
 # Optional view-only login.
 SEAWEED_ADMIN_READONLY_USER=
 SEAWEED_ADMIN_READONLY_PASSWORD=
-# Bound to localhost by default, the same call SEAWEED_S3_BIND makes: storage
+# Bound to localhost by default: storage
 # plumbing, not one of the app's own panels. On a remote host that means
 # unreachable — set 0.0.0.0 and put it behind a reverse proxy.
 SEAWEED_ADMIN_BIND=127.0.0.1
diff --git a/Docker-AIO/.env.seaweedfs.example b/Docker-AIO/.env.seaweedfs.example
index ddef470..3018ad3 100644
--- a/Docker-AIO/.env.seaweedfs.example
+++ b/Docker-AIO/.env.seaweedfs.example
@@ -72,8 +72,6 @@ PB_S3_BUCKET=drivervault
 PB_S3_REGION=us-east-1
 # The gateway image, pinned so a rebuild months from now brings up the same one.
 # SEAWEED_IMAGE=chrislusf/seaweedfs:4.45
-# Host port for the S3 API, so aws-cli and friends can reach it while developing.
-# SEAWEED_S3_PORT=8333
 
 # Existing uploads are NOT migrated when this is switched on: PocketBase copies
 # nothing, so attachments made before the switch stop resolving. Read the file
diff --git a/Docker-AIO/.env.seaweedfs.split.example b/Docker-AIO/.env.seaweedfs.split.example
index e1c8444..fb5e6cc 100644
--- a/Docker-AIO/.env.seaweedfs.split.example
+++ b/Docker-AIO/.env.seaweedfs.split.example
@@ -93,14 +93,14 @@ SEAWEED_ADMIN_PASSWORD=
 
 # --- SeaweedFS host ports (optional; defaults shown) -------------------------
 # Published for aws-cli, `weed shell` and poking around while developing. The
-# stack itself reaches every one of these over the compose network.
+# stack itself reaches every one of these over the compose network, and the S3
+# gateway too, which is not published so a second stack cannot clash on it.
 # Note SEAWEED_VOLUME_PORT: the volume server serves file content by id with NO
 # authentication, so do not carry this mapping over to a shared machine. It
 # lands on 8081 because API_PORT already has 8080.
 # SEAWEED_MASTER_PORT=9333
 # SEAWEED_VOLUME_PORT=8081
 # SEAWEED_FILER_PORT=8888
-# SEAWEED_S3_PORT=8333
 
 # Existing uploads are NOT migrated when this is switched on: PocketBase copies
 # nothing, so attachments made before the switch stop resolving. Read the file
diff --git a/Docker-AIO/README.md b/Docker-AIO/README.md
index 1a58546..6c07791 100644
--- a/Docker-AIO/README.md
+++ b/Docker-AIO/README.md
@@ -131,8 +131,8 @@ copied from the official image, pinned by the `SEAWEED_VERSION` build arg), on
 a `/seaweed/data` volume of its own, with PocketBase's program creating the
 bucket before it serves. One container, two volumes; the cost is that a new
 SeaweedFS is a rebuild rather than a tag change. Inside, the volume server sits
-on **8081** since 8080 is the API Server, and only the gateway is published, on
-loopback by default. The build needs the repo checkout, so either build on the
+on **8081** since 8080 is the API Server, and nothing of SeaweedFS is
+published: PocketBase reaches the gateway inside the container. The build needs the repo checkout, so either build on the
 deploy host or `docker compose push` the image to `AIO_IMAGE` and `pull` it
 there. The external-S3 ones add no containers at all: set `PB_S3_ENDPOINT`, and
 create the bucket yourself.
@@ -155,8 +155,7 @@ programs. One container, three volumes (`PB_DATA`, `SEAWEED_DATA`,
 gateway's program instead of a `seaweedfs-init` container. What survives of
 "split" in there is per-role restart, per-role metrics ports and the admin UI;
 what does not is spreading the roles over hosts. Inside, every role listens on
-loopback, and only the gateway and the admin UI are published, on loopback by
-default.
+loopback, and only the admin UI is published, on loopback by default.
 
 Identities work differently there, and it matters. SeaweedFS reads credentials
 from, in descending priority: an `-s3.config` file, the filer's IAM store, then
@@ -173,7 +172,7 @@ updates that identity in place.
 Set `SEAWEED_ADMIN_PASSWORD`: `weed admin` serves the panel with no
 authentication when it is empty, and a panel that can mint bucket credentials is
 the bucket (the baked-in image refuses to start the panel at all without one).
-In the prod file it is bound to loopback like `SEAWEED_S3_BIND` — it is storage
+In the prod file it is bound to loopback — it is storage
 plumbing, not one of the app's own panels — so a remote host needs
 `SEAWEED_ADMIN_BIND=0.0.0.0` behind a reverse proxy. Neither file publishes
 anything for master, volume and filer: the volume server serves file content by
diff --git a/Docker-AIO/docker-compose.prod.seaweedfs.split.yml b/Docker-AIO/docker-compose.prod.seaweedfs.split.yml
index ad3df60..2cf1d36 100644
--- a/Docker-AIO/docker-compose.prod.seaweedfs.split.yml
+++ b/Docker-AIO/docker-compose.prod.seaweedfs.split.yml
@@ -32,8 +32,8 @@ name: drivervault-aio
 # mounts here unchanged, and vice versa, with no migration either way.
 #
 # Inside the container every SeaweedFS role listens on loopback except the S3
-# gateway and the admin UI, and those two are published on loopback by default,
-# the way the other SeaweedFS files publish them. The volume server serves file
+# gateway and the admin UI. Only the admin UI is published, on loopback by
+# default; PocketBase reaches the gateway inside. The volume server serves file
 # content by id with no authentication at all, so it is never reachable from
 # outside; the admin UI shows what its port would.
 #
@@ -128,14 +128,10 @@ services:
       - "${WEB_PORT:-8090}:80"    # Web App
       - "${PB_PORT:-8070}:8070"   # PocketBase admin UI / API
       - "${API_PORT:-8080}:8080"  # API Server + panel (root /) + /ocpp/{serial}
-      # The S3 gateway, loopback only: PocketBase reaches it inside the
-      # container, so this is here for `aws s3 ls --endpoint-url
-      # http://127.0.0.1:8333` and nothing else. Set SEAWEED_S3_BIND=0.0.0.0 to
-      # expose it, and mean it.
-      - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333"
-      # The admin UI, loopback for the same reason: storage plumbing, not one
-      # of the app's own panels. On a remote host that means unreachable, so
-      # set SEAWEED_ADMIN_BIND=0.0.0.0 and put it behind a reverse proxy.
+      # The S3 gateway is not published: PocketBase reaches it inside the
+      # container. The admin UI is, on loopback: storage plumbing, not one of
+      # the app's own panels. On a remote host that means unreachable, so set
+      # SEAWEED_ADMIN_BIND=0.0.0.0 and put it behind a reverse proxy.
       - "${SEAWEED_ADMIN_BIND:-127.0.0.1}:${SEAWEED_ADMIN_PORT:-23646}:23646"
     volumes:
       # Named volumes by default; set any of them to a host path in .env for a
diff --git a/Docker-AIO/docker-compose.prod.seaweedfs.yml b/Docker-AIO/docker-compose.prod.seaweedfs.yml
index f795068..4ceadab 100644
--- a/Docker-AIO/docker-compose.prod.seaweedfs.yml
+++ b/Docker-AIO/docker-compose.prod.seaweedfs.yml
@@ -107,13 +107,9 @@ services:
       - "${WEB_PORT:-8090}:80"    # Web App
       - "${PB_PORT:-8070}:8070"   # PocketBase admin UI / API
       - "${API_PORT:-8080}:8080"  # API Server + panel (root /) + /ocpp/{serial}
-      # The S3 gateway, loopback only: PocketBase reaches it inside the
-      # container, so this is here for `aws s3 ls --endpoint-url
-      # http://127.0.0.1:8333` and nothing else. Set SEAWEED_S3_BIND=0.0.0.0 to
-      # expose it, and mean it. Nothing else of SeaweedFS is published: the
-      # volume server (8081 inside) serves file content by id with no
-      # authentication at all.
-      - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333"
+      # Nothing of SeaweedFS is published: PocketBase reaches the S3 gateway
+      # inside the container, and the volume server (8081 inside) serves file
+      # content by id with no authentication at all.
     volumes:
       # Named volumes by default; set either to a host path in .env for a bind
       # mount. The API Server keeps no state on disk, so everything it owns
diff --git a/Docker-AIO/docker-compose.seaweedfs.split.yml b/Docker-AIO/docker-compose.seaweedfs.split.yml
index 38dd908..8d71324 100644
--- a/Docker-AIO/docker-compose.seaweedfs.split.yml
+++ b/Docker-AIO/docker-compose.seaweedfs.split.yml
@@ -179,10 +179,7 @@ services:
       # Never serve before an identity exists — see seaweedfs-init above.
       seaweedfs-init:
         condition: service_completed_successfully
-    ports:
-      # The stack reaches the gateway over the compose network; this is here so
-      # `aws s3 ls --endpoint-url http://localhost:8333` works while developing.
-      - "${SEAWEED_S3_PORT:-8333}:8333"
+    # No published port: the stack reaches the gateway over the compose network.
     healthcheck:
       test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8333/healthz || exit 1"]
       interval: 10s
diff --git a/Docker-AIO/docker-compose.seaweedfs.yml b/Docker-AIO/docker-compose.seaweedfs.yml
index 194e9e7..6c4dd93 100644
--- a/Docker-AIO/docker-compose.seaweedfs.yml
+++ b/Docker-AIO/docker-compose.seaweedfs.yml
@@ -42,10 +42,7 @@ services:
     volumes:
       # From here on the attachments live here, not on pb_data.
       - seaweed_data:/data
-    ports:
-      # The stack reaches the gateway over the compose network; this is here so
-      # `aws s3 ls --endpoint-url http://localhost:8333` works while developing.
-      - "${SEAWEED_S3_PORT:-8333}:8333"
+    # No published port: the stack reaches the gateway over the compose network.
     healthcheck:
       test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:9333/cluster/status || exit 1"]
       interval: 10s
diff --git a/Docker/.env.prod.seaweedfs.example b/Docker/.env.prod.seaweedfs.example
index 5efffe6..55d7bd5 100644
--- a/Docker/.env.prod.seaweedfs.example
+++ b/Docker/.env.prod.seaweedfs.example
@@ -120,11 +120,8 @@ PB_S3_REGION=us-east-1
 SEAWEED_DATA=seaweed_data
 # The gateway image, pinned so a redeploy months from now brings up the same one.
 # SEAWEED_IMAGE=chrislusf/seaweedfs:4.45
-# The S3 port is published on loopback only — the stack reaches the gateway over
-# the compose network, and this is for tools like aws-cli. Set
-# SEAWEED_S3_BIND=0.0.0.0 to expose it to other hosts, and mean it.
-# SEAWEED_S3_BIND=127.0.0.1
-# SEAWEED_S3_PORT=8333
+# The S3 gateway publishes no host port: the stack reaches it over the compose
+# network.
 
 # Existing uploads are NOT migrated when this is switched on: PocketBase copies
 # nothing, so attachments made before the switch stop resolving. Read the file
diff --git a/Docker/.env.prod.seaweedfs.split.example b/Docker/.env.prod.seaweedfs.split.example
index 01c9d0d..fce839e 100644
--- a/Docker/.env.prod.seaweedfs.split.example
+++ b/Docker/.env.prod.seaweedfs.split.example
@@ -129,13 +129,7 @@ SEAWEED_DATA=seaweed_data
 # The SeaweedFS image, pinned so a redeploy months from now brings up the same
 # one. All five SeaweedFS containers run it.
 # SEAWEED_IMAGE=chrislusf/seaweedfs:4.45
-# The S3 port is published on loopback only — the stack reaches the gateway over
-# the compose network, and this is for tools like aws-cli. Set
-# SEAWEED_S3_BIND=0.0.0.0 to expose it to other hosts, and mean it.
-# SEAWEED_S3_BIND=127.0.0.1
-# SEAWEED_S3_PORT=8333
-#
-# The master, volume and filer publish no host port at all. The admin UI below
+# The S3 gateway, master, volume and filer publish no host port at all. The admin UI below
 # shows what they would: the volume server in particular serves file content by
 # id with no authentication, so it stays on the compose network. Reach the
 # others with `docker compose exec`.
diff --git a/Docker/.env.seaweedfs.example b/Docker/.env.seaweedfs.example
index 7fedbd4..72b8dc5 100644
--- a/Docker/.env.seaweedfs.example
+++ b/Docker/.env.seaweedfs.example
@@ -92,8 +92,6 @@ PB_S3_BUCKET=drivervault
 PB_S3_REGION=us-east-1
 # The gateway image, pinned so a rebuild months from now brings up the same one.
 # SEAWEED_IMAGE=chrislusf/seaweedfs:4.45
-# Host port for the S3 API, so aws-cli and friends can reach it while developing.
-# SEAWEED_S3_PORT=8333
 
 # Existing uploads are NOT migrated when this is switched on: PocketBase copies
 # nothing, so attachments made before the switch stop resolving. Read the file
diff --git a/Docker/.env.seaweedfs.split.example b/Docker/.env.seaweedfs.split.example
index 3f3b218..81c85e0 100644
--- a/Docker/.env.seaweedfs.split.example
+++ b/Docker/.env.seaweedfs.split.example
@@ -112,14 +112,14 @@ SEAWEED_ADMIN_PASSWORD=
 
 # --- SeaweedFS host ports (optional; defaults shown) -------------------------
 # Published for aws-cli, `weed shell` and poking around while developing. The
-# stack itself reaches every one of these over the compose network.
+# stack itself reaches every one of these over the compose network, and the S3
+# gateway too, which is not published so a second stack cannot clash on it.
 # Note SEAWEED_VOLUME_PORT: the volume server serves file content by id with NO
 # authentication, so do not carry this mapping over to a shared machine. It
 # lands on 8081 because API_PORT already has 8080.
 # SEAWEED_MASTER_PORT=9333
 # SEAWEED_VOLUME_PORT=8081
 # SEAWEED_FILER_PORT=8888
-# SEAWEED_S3_PORT=8333
 
 # Existing uploads are NOT migrated when this is switched on: PocketBase copies
 # nothing, so attachments made before the switch stop resolving. Read the file
diff --git a/Docker/docker-compose.prod.seaweedfs.split.yml b/Docker/docker-compose.prod.seaweedfs.split.yml
index b4642f2..7da1291 100644
--- a/Docker/docker-compose.prod.seaweedfs.split.yml
+++ b/Docker/docker-compose.prod.seaweedfs.split.yml
@@ -30,7 +30,7 @@ name: drivervault
 # filename overlap). So the two files are interchangeable on the same SEAWEED_DATA,
 # with no migration either way. A *second* volume server would need its own.
 #
-# Only the S3 gateway and the admin UI publish a host port. Master, volume and
+# Only the admin UI publishes a host port. The S3 gateway, master, volume and
 # filer are reachable over the compose network, through the admin UI, or with
 # `docker compose exec` — the volume server in particular serves file content by
 # id with no authentication at all, so it has no business on a public interface.
@@ -187,11 +187,7 @@ services:
       # Never serve before an identity exists — see seaweedfs-init above.
       seaweedfs-init:
         condition: service_completed_successfully
-    ports:
-      # Loopback only: the stack reaches the gateway over the compose network,
-      # so this is here for `aws s3 ls --endpoint-url http://127.0.0.1:8333` and
-      # nothing else. Set SEAWEED_S3_BIND=0.0.0.0 to expose it, and mean it.
-      - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333"
+    # No published port: the stack reaches the gateway over the compose network.
     healthcheck:
       test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8333/healthz || exit 1"]
       interval: 10s
diff --git a/Docker/docker-compose.prod.seaweedfs.yml b/Docker/docker-compose.prod.seaweedfs.yml
index 8f9eb96..470af4b 100644
--- a/Docker/docker-compose.prod.seaweedfs.yml
+++ b/Docker/docker-compose.prod.seaweedfs.yml
@@ -46,11 +46,7 @@ services:
       # bind mount, exactly as PB_DATA works. Back it up alongside PB_DATA —
       # from here on the attachments live here, not in the database volume.
       - "${SEAWEED_DATA:-seaweed_data}:/data"
-    ports:
-      # Loopback only: the stack reaches the gateway over the compose network,
-      # so this is here for `aws s3 ls --endpoint-url http://127.0.0.1:8333` and
-      # nothing else. Set SEAWEED_S3_BIND=0.0.0.0 to expose it, and mean it.
-      - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333"
+    # No published port: the stack reaches the gateway over the compose network.
     healthcheck:
       test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:9333/cluster/status || exit 1"]
       interval: 10s
diff --git a/Docker/docker-compose.seaweedfs.split.yml b/Docker/docker-compose.seaweedfs.split.yml
index d701347..fd4e7d3 100644
--- a/Docker/docker-compose.seaweedfs.split.yml
+++ b/Docker/docker-compose.seaweedfs.split.yml
@@ -175,10 +175,7 @@ services:
       # Never serve before an identity exists — see seaweedfs-init above.
       seaweedfs-init:
         condition: service_completed_successfully
-    ports:
-      # The stack reaches the gateway over the compose network; this is here so
-      # `aws s3 ls --endpoint-url http://localhost:8333` works while developing.
-      - "${SEAWEED_S3_PORT:-8333}:8333"
+    # No published port: the stack reaches the gateway over the compose network.
     healthcheck:
       test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8333/healthz || exit 1"]
       interval: 10s
diff --git a/Docker/docker-compose.seaweedfs.yml b/Docker/docker-compose.seaweedfs.yml
index 64f8e98..e71a013 100644
--- a/Docker/docker-compose.seaweedfs.yml
+++ b/Docker/docker-compose.seaweedfs.yml
@@ -37,10 +37,7 @@ services:
     volumes:
       # From here on the attachments live here, not on pb_data.
       - seaweed_data:/data
-    ports:
-      # The stack reaches the gateway over the compose network; this is here so
-      # `aws s3 ls --endpoint-url http://localhost:8333` works while developing.
-      - "${SEAWEED_S3_PORT:-8333}:8333"
+    # No published port: the stack reaches the gateway over the compose network.
     healthcheck:
       test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:9333/cluster/status || exit 1"]
       interval: 10s